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simulation  of  the  Guard  Control  Station 
in  a Computerized  Site  Security 
Monitor  and  Response  System 

R.  T.  Moore 
A.  W.  Holt 
A.  L.  Koenig 
A.  Mink 
G.  Nacht 


This  report  describes  a mock-up  of  a Guard 
Control  Station  that  was  used  in  simulating  the 
performance  of  this  component  of  a Computerized 
Site  Security  Monitor  and  Response  System.  The 
mock-up  was  interconnected  to  three  microcomputer 
systems  in  an  arrangement  that  permitted  simula- 
tion of  physical  security  scenarios  in  an  interac- 
tive mode.  Seven  different  individuals  were  al- 
lowed to  act  as  operators  of  the  Guard  Control 
Station  Console  following  a brief  period  of  train- 
ing. Based  both  on  observations  of  their  actions 
and  on  their  comments,  it  was  determined  that  the 
CSSMRS  concepts  were  effective  and  easy  to  learn. 
The  Console  was  judged  to  have  met  most  design  ob- 
jectives, but  certain  controls  and  displays  were 
identified  as  candidates  for  minor  modification  or 
relocation  to  further  improve  the  overall  effec- 
tiveness of  the  console. 


Key  words:  alarm  annunciation;  physical  security; 
security  systems;  simulation. 


INTRODUCTION 


The  Computerized  Site  Security  Monitor  and  Response 
System  (CSSMRS)  [1]  was  conceived  as  an  integrated,  computer 
based  system  that  could  enhance  the  physical  security  of 
storage  sites  for  nuclear  weapons  and  materials  through  the 
use  of  state-of-the-art  technology.  It  proposed  a distri- 
buted network  of  microprocessors,  each  associated  with  the 
security  measures  allocated  to  a protected  zone.  These 
measures  might  include  sensors  to  detect  an  intrusion,  phy- 
sical or  psychological  deterrents  to  forced  entry,  closed 
circuit  television  to  assess  sensor  alarms,  and  features  to 
aid  in  the  control  of  access  to  that  zone. 
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Each  of  these  remote  microprocessors  communicates  with 
a central,  triply  redundant,  computer  system  via  a dual 
loop,  fiber  optic,  CROSSFIRE [*]  data  communications  network. 
The  central  computer  complex  maintains  a continuously  updat- 
ed record  of  the  status  of  each  of  the  security  zones.  It 
presents  appropriate  information  and  instructions  to  each  of 
the  two  Guard  Control  Stations,  (GCS)  as  well  as  to  higher 
command  levels.  It  receives,  relays, or  executes  commands 
from  the  GCS.  A highly  simplified  block  diagram  of  CSSMRS 
is  shown  in  figure  lA. 
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A 

/ \ 

/ \ 


perator 


Figure  lA.  Block  Diagram  of  CSSMRS. 


In  figure  IB,  the  block  diagram  of  the  CSSMRS  has  been  ex- 
panded somewhat  to  show  additional  functional  details. 


[*]  The  CROSSFIRE  data  link  is  an  invention  of  Arthur 
W.  Holt. 
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Figure  IB.  Expanded  Block  Diagram  of  CSSMRS. 
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The  CSSMRS  was  designed  to  provide  timely,  accurate  and 
unambiguous  information  about  the  site  security  status  and 
the  progress  of  any  attempted  intrusion.  To  the  extent  that 
is  feasible,  appropriate  response  initiatives  are  programmed 
into  the  system.  Changes  in  site  security  status  and  the 
resulting  response  actions  are  automatically  reported  up- 
channel  to  higher  command  levels.  Backup  and  reserve  forces 
are  automatically  called  out  in  the  event  of  certain  iden- 
tifiable threat  situations,  particularly  those  in  which  the 
continued  survival  of  local  guard  forces  might  be  in  doubt. 


Design  Objectives 

While  the  overall  design  objective  of  CSSMRS  was  that 
of  providing  improved  physical  security,  it  was  recognized 
that  this  objective  could  only  be  realized  with  a robust, 
reliable  system,  that  is  easy  to  use,  and  is  tolerant  of  hu- 
man foibles.  Users  of  an  unreliable  system  will  not  develop 
confidence  in  it.  Even  when  an  unreliable  system  is  func- 
tioning correctly,  there  may  be  an  element  of  residual  doubt 
about  the  correctness  of  its  operation.  A system  that  is 
difficult  to  learn  to  use  or  to  use,  will  cause  the  user  to 
perform  more  slowly,  commit  more  errors,  or  both. 


Features  Contributing  to  Reliability 

Some  of  the  more  significant  CSSMRS  design  features 
that  contribute  to  system  reliability  and  integrity  include 
the  following: 

The  CROSSFIRE  data  link  connecting  the  remote  micropro- 
cessors with  the  central  computer  complex  (CU)  uses  a dual 
loop  fiber  optic  channel  that  does  not  produce  compromising 
emanations  and  is  immune  to  electromagnetic  interference. 
The  arrangement  is  highly  tamper  resistant,  and  communica- 
tion cannot  be  lost  as  a result  of  any  single  break,  even  of 
both  fibers  as  described  in  [1] . Signalling  is  at  a rate 
that  permits  the  use  of  inexpensive,  lightly  stressed,  com- 
ponents but  still  permits  response  times  that  are  short  com- 
pared to  human  reaction  times.  The  use  of  dual  loops  to- 
gether with  a continuous  polling  mode  of  operation  makes  it 
possible  to  immediately  detect  and  localize  any  outage. 

Communications  between  the  site  and  higher  headquarters 
are  conducted  over  two  different,  alternately  routed,  hard 
wire,  circuits.  Continuous  testing  insures  the  prompt 
detection  of  any  fault  in  either  of  these  redundant  cir- 
cuits. 
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The  central  computer  complex  is  triply  redundant. 
Correct  system  operation  continues  as  long  as  any  two  of 
these  three  computers  are  operational,  A fourth  computer  is 
on  ready  stand-by  for  plug-in  replacement  if  any  one  of  the 
three  working  units  should  fail. 


The  use  of  mechanically  rotating  memory  components  has 
been  banned  throughout  the  system.  This  single  design 
feature  eliminates  a major,  if  not  the  major,  cause  of  com- 
puter system  failures. 

Two  independent  Guard  Control  Stations  are  provided. 
Either  one  of  these  is  capable  of  performing  all  necessary 
man/machine  interface  functions.  This  provides  an  opportun- 
ity for  load  sharing  as  well  as  providing  reliability 
through  redundancy. 

Alternative  back-up  power  sources  have  been  specified 
for  all  system  components.  There  is  a back-up  for  the 
back-up  at  the  central  station,  and  the  weapon  storage  maga- 
zines are  equipped  with  an  emergency,  manual  override  for 
the  electronic  lock[*]  that  does  not  require  electrical 
power  to  operate. 


Features  Contributing  to  Ease  of  Operation 

The  general  arrangement  of  the  GCS  console  is  based  on 
the  human  engineering  design  criteria  set  forth  in  MIL- 
STD-1472A  [2] . Other  features  that  contribute  to  the  ease 
of  learning  to  operate  the  system  include  the  following: 

Minimal  special  skills  are  required  of  an  operator. 
The  GCS  operator  does  not  have  to  know  how  to  type  in  order 
to  operate  the  system.  All  controls  are  functional,  and  la- 
beled in  simple,  easy  to  understand  terms.  The  selection  of 
primary  controls  that  are  candidates  for  actuation  under  any 
given  circumstance  is  guided  by  illuminating  those  controls. 
Flashing  lights  indicate  "must  choose”  options.  Steady 
lights  indicate  reasonable  but  non-mandatory  choices.  Gui- 
dance messages  are  provided  in  the  event  an  inappropriate 
control  is  actuated.  Certain  critical  and  potentially  con- 
sequential actions  require  that  the  action  be  confirmed  be- 
fore it  is  executed.  This  provides  protection  against  ac- 
cidentally invoking  one  of  these  actions. 


[*]  The  electronic  lock  is  an  invention  of  Jacob  Rabi- 
now  and  Arthur  W.  Holt, 
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Closed  circuit  television  (CCTV)  coverage  of  a zone  is 
automatically  selected  and  presented  to  the  GCS  operator 
whenever  an  alarm  occurs  in  that  zone.  This  permits  immedi- 
ate assessment  prior  to  any  action  on  the  part  of  the  opera- 
tor. This  is  particularly  useful  in  protecting  against  high 
speed  penetration  of  an  outer  perimeter  zone  where  the  pene- 
trator  is  within  the  field  of  view  of  the  camera  for  only 
two  or  three  seconds. 

Information  is  presented  to  the  operator  both  visually 
and  audibly.  Alarms  are  accompanied  by  a series  of  sonic 
alerts,  and  acknowledgement  must  be  made  in  less  than  40 
seconds  or  reserve  forces  (BAF)  are  called  out  automatical- 
ly. Alarm  information  is  displayed  on  a Digital  Display 
Unit  (DDU) , and  is  also  articulated  by  a speech  synthesis 
system.  The  last  audible  message  may  be  repeated  by  the 
operator  on  command. 

Special  steps  have  been  taken  to  protect  the  operator 
from  information  overload.  When  there  are  multiple  alarms, 
the  details  about  only  one  of  them  are  presented  to  the 
operator.  The  display  does  indicate  the  number  of  other 
alarms  so  that  the  operator  is  aware  of  the  backlog  without 
being  overwhelm.ed  by  its  detail.  Alarms,  other  than  the  one 
currently  being  displayed,  are  held  in  a rotary  queue.  They 
can  be  brought  up  sequentially  by  actuating  a single  con- 
trol. The  operator  does  not  have  to  know  the  identity  of  any 
alarmed  zones  to  call  them  up  on  the  display. 

Site  status  information  is  displayed  whenever  any  zone 
is  selected  that  is  not  in  an  alarm  condition.  In  addition, 
overall  site  summary  information  is  displayed  by  a cluster 
of  colored  indicator  lamps  for  quick  look  assessment  by  su- 
pervisory personnel. 

Controls  for  the  Pan,  Tilt  and  Zoom  functions  of  CCTV 
cameras  that  are  so  equipped  have  been  human  engineered  so 
that  the  hand  motions  are  the  same  as  required  if  the  opera- 
tor were  holding  the  camera  in  his  hand. 


Purpose  of  the  Mock-up 

The  Guard  Control  Station  mock-up  (GCS)  was  assembled 
to  provide  a test  bed  that  could  be  used  with  computer  simu- 
lation to  test  and  evaluate  the  various  novel  design 
features  affecting  the  man-machine  interface  in  the  CSSMRS. 
In  particular,  it  was  intended  to  provide  information  about 
the  ease  or  difficulty  that  non-technical  personnel  would 
have  in  learning  to  use  the  system,  and  to  show  whether  or 


-6- 


not  that  use  would  be  direct,  easy,  and  relatively  error 
free.  It  was  expected  to  help  provide  answers  to  questions 
of  the  following  types; 


Do  users  find  that  the  Guard  Control  Station  is  friendly 
or  intimidating?  Hopefully,  the  increasing  availa- 
bility and  popularity  of  video  games  may  have  provid- 
ed opportunities  for  many  non- technical  individuals 
to  use  computer  based  devices  and  learn  to  feel  com- 
fortable with  them. 


Are  the  locations  of  the  controls  and  indicators  handy 
and  easy  to  use  and  do  they  have  clear  and  easily  un- 
derstood labels  and  nomenclature?  This  was  a major 
objective  in  the  layout  of  the  GCS,  but  only  actual 
operating  experience  would  reveal  how  well  that  ob- 
jective has  been  attained. 


Are  the  cues  and  guidance  messages  adequate  to  support 
effective  operation  of  the  GCS  by  an  operator  with 
limited  technical  background  and  minimal  training? 
Extensive  audible  and  visual  cues  have  been  provided 
including  sonic  alarms,  voiced  messages,  and  the  use 
of  colors  and  lights  in  the  controls  and  indicators. 

Are  the  displays,  including  both  graphics  and  video, 
adequate  in  terms  of  size,  resolution,  location,  and 
information  content? 


These  and  related  questions  could  best  be  answered  by 
the  construction  of  a GCS  that  could  be  used  in  a simulation 
environment  to  provide  a highly  realistic  demonstration  of 
the  behavior  of  such  a station  in  a real  CSSMRS.  Such  a 
model  would  provide  nearly  all  of  the  audible,  visual  and 
tactile  stimuli  to  its  operator  that  would  be  provided  by  a 
real  GCS.  It  would  react  to  his  responses  in  the  same  way 
as  a real  GCS.  By  teaching  operators  to  use  the  GCS  and  by 
observing  their  actions  during  the  conduct  of  threat 
scenarios  on  the  simulator,  it  was  expected  that  insight 
could  be  gained  regarding  the  adequacy  of  the  GCS  design  and 
its  interaction  with  the  balance  of  a CSSMRS. 
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INITIAL  DESIGN 


A detailed  set  of  performance  specifications  was 
developed  from  a general  description  of  the  GCS  component  of 
CSSMRS  [1] . These  were  in  the  form  of  state  descriptions 
and  contained  a list  of  all  GCS  controls,  indicators,  and 
displays,  and  reflected  their  response  to  differing  stimuli. 

A complete  state  space  description  for  the  GCS  was 
found  to  be  too  large  to  be  accomplished  within  available 
resources.  Instead,  a number  of  major  conditions  were  iden- 
tified, which  could  co-exist  at  the  same  time.  A state 
space  description  of  each  of  these  major  conditions  was 
specified  which  assumed  the  major  conditions  existed  in- 
dependent of  each  other.  During  a second  iteration  of 
these  independent  state  spaces,  an  attempt  was  made  to 
include  variations  resulting  from  the  co-existence  of 
other  major  conditions.  The  resulting  specifications  pro- 
vide a description  for  each  state  of  each  major  condi- 
tion. This  description  consists  of  the  current  condition  of 
the  GCS  (its  initial  state),  the  action  causing  a transition 
and  the  resulting  condition  of  the  GCS  (its  next  state) . 
The  condition  of  the  GCS,  as  described  includes  the  controls 
that  are  active,  the  illumination  state  of  each  indi- 
cator and  control,  the  contents  of  each  CCTV  monitor,  any 
messages  on  the  DDU  that  are  of  concern  to  the  current 
state,  and  the  contents  of  a new  message  and  its  disposition 
for  the  DDU,  the  Voice  Unit  and  the  Logging  Printer. 

Specifications  for  the  physical  layout  of  the  Console 
portion  of  a GCS  were  taken  from  the  MIL-STD-1472A  [2] . A 
cardboard  mock-up  was  made  so  that  experimentation  with 
various  positions  and  combinations  of  the  controls,  indica- 
tors and  displays  could  be  conducted. 

At  this  point  it  was  necessary  to  consider  the  fabrica- 
tion of  the  GCS  Console,  the  hardware  to  be  used,  and 
the  software  required  to  drive  the  hardware.  For  the  sake 
of  expediency  and  economy,  the  selection  of  hardware  and 
software  were  based  on  availability  and  familiarity  rather 
than  optimization  of  function  and  speed. 

The  hardware  would  be  centered  around  existing,  avail- 
able processors.  The  GCS  Console,  its  lights,  switches, 
displays,  and  the  interfaces  between  them,  and  the  proces- 
sors would  be  obtained  commercially,  if  they  were 
available.  Otherwise  they  would  be  custom  designed  and  fa- 
bricated . 
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The  software  would  be  written  in  the  C language  [* ] 
with  some  assembly  language  where  necessary.  Three 
cooperating  processes  were  involved  in  the  software  design. 
One,  the  Console  Process,  was  to  service  the  console  inputs 
and  outputs.  The  second,  the  Event  Process,  was  to  service 
and  maintain  the  history  of  events  from  the  individual  zones 
via  the  C.U.  and  from  the  Console  Process.  A third  pro- 
cess, the  Director  Process,  was  also  required  to  coordinate 
events  and  simulate  the  C.U.  and  the  actions  that  could  oc- 
cur at  the  various  zones. 

Each  process  was  placed  on  a separate  processor.  This 
allowed  the  Console  Process  to  run  stand  alone  in  a polling 
mode,  while  the  other  processes  were  run  under  UNIX  [3]  [4] 
an  interupt  driven  operating  system.  Running  under  an 
operating  system  was  possible  only  for  this  mock-up,  since 
time  was  not  as  critical  for  the  Event  and  Director 
processes  as  it  was  for  the  Console  Process.  UNIX  also 
served  as  the  development  system  environment. 

These  initial  design  decisions  led  to  an  efficient  im- 
plementation of  the  GCS  simulation  model  in  a straight- 
forward manner. 


SYSTEM  CONFIGURATION 


The  principal  GCS  components  of  CSSMRS  in  this  simula- 
tion model  are  shown  in  figure  2.  They  consist  primarily  of 
three  parts,  the  Console  itself,  the  Console  Process  and  the 
Event  Process.  GCS  features  detailed  in  NBSIR  79-1725  that 
were  not  implemented  in  this  model  include  the  Logging 
Printer,  the  Audio  Recorder,  the  Geographies  Display  Unit, 
the  Radio,  Telephone  and  Intercommunications  facilities,  and 
the  Duress  alarm  functions. 


The  Console  is  the  principal  interface  between  the 
Operator  and  CSSMRS.  It  provides  the  Operator  with  closed 
circuit  television  (CCTV)  pictures  of  the  site,  interactive 
controls,  and  both  audio  and  video  messages.  The  messages 
can  be  of  three  types;  routine  status  messages,  alarm  mes- 
sages, or  operator  guidance  messages.  Status  messages  may 
describe  the  state  of  equipment  or  conditions  on  the  site. 


[*]  UNIX  is  a trademark  of  Bell  Laboratories. 
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Figure  2.  Guard  Control  Station 

such  as  malfunctioning  sensors,  presence  of  uncleared  alarm 
conditions,  or  zones  in  access  condition.  A new  alarm  con- 
dition replaces  status  messages  and  demands  positive  ack- 
nowledgement by  the  Operator.  When  that  acknowledgement  oc- 
curs, the  message  is  expanded  to  provide  details  about  the 
nature  of  the  alarm  and  suggested  Operator  actions.  Opera- 
tor guidance  messages  are  presented  to  indicate  results  of 
tests,  candidate  Operator  actions,  or  actuation  of  an  inap- 
propriate control.  As  a message  is  presented  to  the  Opera- 
tor on  the  Digital  Display  Unit  (DDU) , it  is  also  vocalized 
by  a Voice  Unit.  Controls  on  the  Console  allow  the  Operator 
to  either  have  the  last  voice  message  repeated  if  desired, 
or  to  turn  the  Voice  Unit  off  if  the  audio  is  distracting. 

The  function  of  the  Console  Process  is  to  service  the 
Console.  It  polls  the  state  of  the  Console's  controls  and 
detects  any  changes.  It  exchanges  messages  with  the  Event 
Process  and  maintains  a necessary  subset  of  the  System's  da- 
tabase for  its  use.  It  checks  the  legality  of  the 
Operator's  actions  and  generates  guidance  messages  for  cer- 
tain incorrect  actions.  It  reflects  the  current  state  of 
the  site  by  various  indicator  lights  on  the  Console,  mes- 
sages displayed  on  the  DDU,  and  outputs  by  the  Voice  Unit. 

The  function  of  the  Event  Process  is  the  maintenance  of 
the  System's  database,  i.  e.,  the  history  of  events  from  the 
Console  Process  and  the  CU . It  maintains  a detailed  list  of 
the  state  of  each  zone  (secure,  accessed,  alarmed,  etc.,) 
and  the  state  of  each  Sensor  and  Forced  Entry  Deterrent  dev- 
ice (FED)  at  each  zone  (disabled,  active,  alarmed,  etc.,). 
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It  maintains  a list  of  all  DDU  messages  currently  resident 
at  the  Console  Process.  The  Event  Process  communicates  with 
the  Console  Process  and  with  the  CU.  In  many  cases  the 
Event  Process  is  able  to  determine  the  preferred  choice  of 
Operator  response  to  the  current  site  status  and,  via  mes- 
sages to  the  Console  Process,  issue  guidance  prompts  to  the 
Operator . 

A third  process,  the  Director  Process,  was  necessary  to 
simulate  actions  at  the  various  zones  which  were  forwarded 
via  the  dual  loop  communications  network,  filtered  through 
the  CU,  and  passed  to  the  GCS . This  was  the  means  by  which 
sensor  alarms,  maintenance  functions,  equipment  failures, 
and  other  zone  and  CU  events  were  simulated.  Since  this 
Process  is  not  actually  part  of  the  GCS  model,  it  will  not 
be  discussed  in  depth  in  this  report. 

Each  of  the  processes  was  placed  on  a separate  proces- 
sor. The  reasons  for  this  were  dictated  by  requirements  and 
system  considerations  and  will  be  discussed  in  later  sec- 
tions of  this  report.  Modified  16-bit  parallel  ports  were 
used  for  communications  between  processes.  Since  the  stan- 
dard circuit  cards  for  these  ports  were  designed  for  commun- 
ication between  a processor  and  a peripheral  device,  they 
had  to  be  modified  for  a processor-to-processor  communica- 
tion link. 


Description  of  the  GCS  Console 


The 
sole  is 
pedestal 
on  the 
ter  face 
pedestal 
switches 


GCS  Simulation  Model  is  shown  in  figure  3.  The  Con- 
mounted  on  a dual  pedestal  base  where  each 
is  a standard  19  inch  equipment  rack.  The  pedestal 
left  side  contains  the  Console  Processor,  in- 
and  driver  circuit  cards,  and  power  supplies.  The 
on  the  right  side  contains  the  Voice  Unit  and  video 
for  the  CCTV's. 


The  vertical  portion  of  the  Console  may  be  considered 
as  four  functional  sections:  the  Left  and  Right  CCTV  Moni- 
tors Sections,  the  Status  Summary  Display  and  the 
DDU  Section.  These  will  each  be  described  in  detail  below. 
The  letters  in  the  illustrations  are  used  to  identify  the 
various  components  of  the  System  in  the  descriptions  that 
follow. 
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Figure  3.  Overview  of  the  GCS  Console 
Digital  Display  Unit  (A) 


The  Digital  Display  Unit,  DDU,  figure  4,  is  central  to 
the  GCS.  It  is  a 30.5  cm  (12  inch)  diagonal  screen  cathode 
ray  tube  capable  of  displaying  information  using  a format  of 
24  lines  of  80  characters  each.  It  is  also  capable  of 
displaying  special  information  using  any  combination  of  dou- 
ble width  or  double  height  characters.  For  this  simula- 
tion model  the  DDU  displays  four  classes  of  information: 
new  alarm  information,  alarmed  zone  information,  status 
information  and  guidance  messages.  These  messages  were  also 
audibly  annunciated  when  they  were  initiated. 
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Figure  4.  Digital  Display  Unit 

When  an  alarm  occurs  (a  sensor  has  been  activated) , the 
information  currently  displayed  on  the  DDU  is  removed  and 
replaced  with  a special  "Acknowledge"  request  to  the 
Operator,  figure  5.  This  also  starts  an  audio  alarm  se- 
quence which  will  be  explained  later.  Other  new  alarms 
cause  a "More  Alarms"  message  to  be  added  to  the  screen, 
figure  6. 


All  new  alarm  messages  are  double  wide  except  for  the  word 
"Acknowledge",  which  is  double  height  and  width.  When 
the  Operator  acknowledges  the  new  alarm  then,  depending 
on  the  state  of  the  zone,  the  DDU  will  display  either  site 
status  information  or  alarmed  zone  information. 
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Figure  5.  Alarm  message. 
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If  the  Console  controls  are  associated  with  or  logical- 
ly attached  to  an  alarmed  zone,  then  the  information 
displayed  on  the  DDU  is  specific  to  that  zone,  figure  7. 
It  will  tell  the  Operator,  for  example,  which  sensors  at 
that  zone  are  alarmed,  which  equipment  at  that 
zone  is  malfunctioning,  the  state  of  the  Forced  Entrance 
Deterrent  Systems  (FEDS)  at  that  zone  and  how  many  other 
zones  are  alarmed.  All  information  displayed  in  this  format 
is  double  wide. 


Figure  7.  Zone  specific  alarm  information. 


If  the  Console  controls  are  attached  to  a non- 
alarmed  zone  then  site  status  information  is  displayed,  fig- 
ure 8.  This  is  not  zone  specific  and  will  tell  the  Opera- 
tor, for  example,  which  Operators  are  currently  logged 
in,  which  zones  are  in  access,  which  equipment  is  mal- 
functioning and  at  which  zone,  how  many  zones  are  in  the 
alarmed  state  and,  if  there  are  any  communication 
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failures,  where  and  what  type  of  failures  have  occurred. 
This  information  is  displayed  in  the  standard  sized  format 
except  for  the  number  of  zones  in  the  alarmed  state.  This 
message  is  double  width  so  that  it  may  be  more  readily  seen. 

The  bottom  line  of  the  DDU  is  used  for  guidance  mes- 
sages to  the  GCS  Operator,  figure  8.  These  messages  usually 
indicate  inappropriate  use  of  a control  or  recommended 
response  actions  to  the  current  situation. 


Figure  8.  A guidance  message  at  the  bottom  of  the  display. 
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Sonic  Alarms  (B) 


The  detection  of  a new  alarm  condition  starts  a se- 
quence of  audio  alarms.  This  sequence  is  also  initiat- 
ed by  the  GCS  Operator  actuating  the  FIRE  FEDS,  the  CALL  BAF 
or  the  CALL  BAF  & ARF  Controls.  (These  Controls  are 
described  later  in  this  report.)  This  audio  alarm  sequence 
is  terminated  as  soon  as  the  GCS  Operator  ack- 
nowledges the  new  alarm  condition  or  verifies  the  action. 
The  first  tone  is  2900  Hz  interrupted  and  lasts  for  15 
seconds.  The  second  tone  is  4500  Hz,  steady,  and  lasts  for 
15  seconds.  The  third  and  final  tone  in  the  sequence  is  a 
very  loud  buzzer  and  lasts  until  an  Operator  acknowledges. 


CCTV  Monitors  (C,  D) 


A pair  of  CCTV  Monitors,  figures  9 and  10,  are  mounted 
on  either  side  of  the  DDU.  At  the  GCS  Operators  discre- 
tion either  pair  may  be  connected  to  the  assessment 
camera (s)  at  any  zone  that  is  equipped  with  cameras. 
Normally,  the  other  Monitor  pair  is  dark.  When  an  alarm 
condition  occurs,  the  previously  dark  CCTV  Monitor  pair  is 
automatically  selected  and  connected  to  the  camera (s)  at  the 
alarming  zone.  If  there  is  a pair  of  cameras  at  a partic- 
ular zone  then  both  Monitors  are  used.  If  there  is  only 
one  camera  available  then  only  the  lower  Monitor  is  used  and 
the  upper  one  is  dark.  In  all  cases  any  Monitor  not  con- 
nected to  a camera  is  dark. 


CCTV  Monitor  Display  (E,  F) 


Associated  with  each  Monitor  pair,  (see  figure  9,  for 
example)  there  is  an  LCD  numeric  display  (E)  indicating 
the  zone  whose  camera  is  connected  to  the  Monitor.  Also 
there  is  a set  of  indicators  (F)  showing  which  types  of 
camera  controls  (pan,  tilt,  etc) , if  any,  are  available  at 
that  zone. 
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Figure  9.  Right-hand  monitor  pair 
Key  Port  (G) 


This  is  the  connector,  figure  9,  into  which 
the  Electronic  Keys  are  inserted.  It  permits  the  loading 
of  a random  number  code  and  time  period  for  which  this  code 
is  valid. 
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Figure  10.  Left-hand  monitor  pair 


Voice  Unit  Speaker  (H) 


The  GCS  Simulation  Model  is  equipped  with  a 
speech  synthesizer.  This  permits  the  annunciation  of 
each  message  as  it  is  displayed  on  the  DDU,  thus  providing 
both  audible  and  visible  means  of  information  transfer  from 
the  System  to  the  GCS  Operator.  Figure  9 shows  the  location 
of  the  speaker  for  this  Voice  Unit. 


Status  Summary  Display  (I) 


The  Status  Summary  Display,  figure  11,  is  a 
six  indicator  lights.  These  indicators 
site  status  information  to  the  Operator.  Their 
are  summarized  in  Table  1. 


group  of 
provide 
functions 


Figure  11 


Site  status  summary  display 


TABLE  1 — Site  Status  Summary  Display 


Indicator  Color 

Function 

Repairs  White 

Required 

ON  when  any  critical  system 

component  is  in  need  of  mainten- 
ance action  , e.g.,  sensor  has 
failed  test  or  a zone  is  operat- 
ing on  backup  battery  power.  Can 
be  ON  in  company  with  any  other 
indicator . 

Contention  Yellow 

ON  for  the  duration  of  any  con- 
flicting or  contentious  commands 
issued  by  the  two  guard  control 
stations.  Can  be  ON  in  company 
with  any  other  indicator. 

Communication  Blue 

Loss 

ON  when  there  is  a loss  of  comm- 
unication with  any  zone  causing 
that  zone  to  be  assumed  to  be 
operating  in  autonomous  mode. 
Can  be  ON  with  any  other  ind- 
icator except  "Secure". 

Secure  Green 

All  zones  in  the  site  are  secure. 
This  light  can  be  ON  only  with 
with  "Contention"  or  "Repairs 
Required".  Lighting  of  any 
other  indicators  causes  this 
one  to  be  turned  OFF. 

Alarm  Red 

(Blinking) 

Unacknowledged  alarm  condition 
exists.  This  changes  to  Red 
(steady)  when  acknowledgement 
occurs.  Can  be  ON  with  any  other 
indicator  except  "Secure". 

Red 

(Steady) 

Acknowledged  but  uncleared  alarm 
conditions  exist.  Can  be  ON 
with  any  other  indicator  except 
"Secure" . 

Access  Yellow 

Authorized  Access  is  occurring 
in  one  or  more  zones.  Can  be 
ON  with  any  other  indicator 
except  "Secure". 
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The  horizontal  portion  of  the  GCS  console  is  shown  on 
figure  12.  All  of  the  controls  that  the  Operator  must  han- 
dle are  located  on  this  horizontal  area  which  is  shown  in 
more  detail  in  figures  13  through  15. 


Figure  12.  Horizontal  console  panel 


Monitor  Pointing  Switch  (J) 

A Monitor  Pointing  Switch  (MPS),  figure  13,  is  provided 
on  the  Console  to  facilitate  the  rapid  and  unambiguous 
switching  of  CCTV  Monitors  and  attachable  Controls  from  one 
alarmed  zone  to  another. 

The  MPS  is  a two  position,  toggle  switch  with  a hand 
sized  handle  having  a light  at  the  outer  end.  The  throw  is 
about  90  degrees.  The  tip  of  the  handle  always  points  to- 
ward the  CCTV  Monitor  associated  with  the  currently  attached 
zone.  If  the  switchable  controls  are  not  attached  to  a 
zone,  then  the  CCTV  Monitor  to  which  the  MPS  points  is  dark. 
The  functions  of  the  MPS  are  summarized  in  Table  2. 
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The  indicator  light  in  the  end  of  the  MPS  handle  acts 
as  a prompt  to  the  Operator  in  requesting  an  acknowledgement 
when  a new  alarm  condition  is  detected.  It  flashes  when  a 
new  alarm  condition  is  detected  on  a previously  secure  site. 
It  flashes  alternately  with  the  light  in  the  ACKNOWLEDGE 
switch  (K)  if  a new  alarm  is  detected  at  a zone  not  al- 
ready alarmed  while  there  are  other  uncleared,  acknowledged 
alarmed  zones  present.  The  light  is  turned  off  when  the  ack- 
nowledgment occurs. 


Figure  13.  Center  group  of  controls 
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TABLE  2 


Functions  of  the  Monitor  Pointing  Switch 


1)  When  the  MPS  is  switched  from  one  side 
to  the  other,  the  CCTV  Monitors  from  which  it  is 
moved  go  dark.  The  dark  Monitors  are  now  ready  to 
receive  the  video  from  the  cameras  at  any  newly 
alarmed  zone. 

2)  All  outstanding,  unacknowledged 
(new)  alarms  are  acknowledged  and  the  zones  at 
which  these  alarms  have  occured  are  added  to  the 
alarm  queue. 

3)  If  the  site  is  secure  (no  out- 
standing, uncleared  alarms)  and  a zone  has  been 
selected  to  which  the  CCTV  Monitors  and  switchable 
Controls  are  attached,  then,  as  the  MPS  is  moved 
from  one  side  to  the  other,  the  video  will 
also  move  from  the  Monitors  on  one  side  to  the 
other.  That  is,  the  video  always  appears  on 
the  side  to  which  the  MPS  points.  The  CCTV  Moni- 
tors to  which  the  MPS  does  NOT  point  will  normally 
be  dark. 


4)  If  there  is  only  one,  acknowledged,  un- 
cleared alarmed  zone,  then,  when  the  MPS  is 
moved  from  one  side  to  the  other,  the  switchable 
Controls  will  be  attached  to  this  zone  and  the 
video  from  the  cameras  at  this  zone  will  be 
displayed  on  the  Monitors  to  which  the  MPS  now 
points . 


5)  If  there  is  more  than  one  ack- 
nowledged, uncleared  alarmed  zone,  then  opera- 
tion of  the  MPS  attaches  the  CCTV  Monitors 
and  switchable  Controls  to  each  of  the  alarmed 
zones  in  turn.  That  is,  the  zone  at  the  top  of 
the  alarm  queue  is  attached  and  the  previously  at- 
tached zone  is  moved  to  the  bottom  of  the 
queue.  This  way  each  of  the  alarmed  zones  may  be 
rapidly  examined  in  turn  merely  by  moving  the  MPS 
from  one  side  to  the  other. 

6)  If  there  are  alarmed  zones  in  the 
queue  and  a new  alarm  is  detected  at  a 
zone  not  currently  attached,  then  the  video  from 
that  newly  alarmed  zone  will  appear  on  the  previ- 
ously dark  CCTV  Monitors  (the  side  to  which  the 
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MPS  is  NOT  pointing) , Operation  of  the  MPS  will 
then  acknowledge  the  new  alarm  and  add  it  to  the 
top  of  the  alarm  queue.  The  MPS  now  points  to  the 
CCTV  Monitors  where  the  newly  alarmed  zone's 
video  is  displayed,  and  the  switchable  controls 
are  attached  to  this  zone.  The  CCTV  Monitors  on 
the  other  side  will  go  dark.  If  the  previously 
attached  zone  is  on  the  alarm  queue,  it  is  moved 
to  the  bottom. 


Acknowledge  (K) 


The  ACKNOWLEDGE  switch,  figure  13,  is  a momentary  ac- 
tion, lighted  push  switch.  Its  operation  will  ack- 
nowledge all  outstanding,  unacknowledged  alarms,  but  will 
not  change  the  zone  to  which  the  CCTV  Monitors  and  switch- 
able  Controls  are  attached. 

The  indicator  light  in  this  switch  acts  as  a prompt 
to  the  Operator  to  acknowledge  newly  detected  alarm  condi- 
tions. It  flashes  if  a previously  unalarmed  sensor  is 
alarmed  at  a zone  already  in  the  alarm  queue.  It  flashes 
alternately  with  the  light  in  the  MPS  handle  if  a new  alarm 
is  detected  at  a zone  not  previously  alarmed  while  there  are 
other  uncleared,  acknowledged  alarmed  zones  present.  The 
light  is  turned  off  when  the  acknowledgment  occurs. 

Operation  of  this  switch  when  there  are  no  outstand- 
ing alarms  to  acknowledge  causes  an  audible  beep  to 
occur  and  a guidance  message,  "No  alarm  to  acknowledge",  to 
appear  on  the  DDU  and  to  be  vocalized. 


10-Digit  Keypad  and  Display  (L,  M) 


The  10-Digit  Keypad  (L) , figure  14,  is  the  means  by 
which  the  GCS  Operator  may  enter  numerical  data  into  the 
System.  This  data  may  represent  either  the  zone  number  to 
which  the  Operator  wishes  to  attach  the  CCTV  Monitors  and 
the  switchable  Controls  or  the  identification  number  of  the 
GCS  Operator  who  wishes  to  log  on  or  to  log  off  duty.  A 
CLEAR  Key  is  provided  to  erase  incorrect  entries. 
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Figure  14.  Right-hand  control  group 

Associated  with  the  10-Digit  Keypad  is  an  LCD  10-Di- 
git  Display  (M) . As  a number  is  entered  via  the  Keypad  it 
appears  on  the  Display.  That  is,  it  is  appended  onto  the 
right  of  the  previously  entered  digits.  The  number 
remains  on  the  Display  until  it  is  either  erased  by  use  of 
the  CLEAR  Key  or  entered  into  the  system  by  use  of  the 
SELECT  ZONE  Control  (N)  or  the  LOGIN  (W)  or  LOGOUT  (X)  Con- 
trols 
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Select  Zone  (N) 


The  SELECT  ZONE  Control,  figure  13,  is  a lighted, 
momentary  action,  push  switch.  It  is  used  in  conjunction 
with  the  Ten  Digit  Keypad.  If  a valid  zone  number  is  entered 
into  the  Ten  Digit  Display  via  the  Keypad  then  the  CCTV 
Monitors  and  switchable  Controls  may  be  attached  to  that 
zone  by  the  actuation  of  the  SELECT  ZONE  Control. 

If  there  is  no  zone  number  in  the  Ten  Digit  Display 
prior  to  actuating  the  SELECT  ZONE  Control  then  a Gui- 
dance Message,  "No  Zone  Number  Entered",  is  displayed  on  the 
DDU  and  is  vocalized  by  the  Voice  Unit.  Similarly,  if  an 
invalid  zone  number  is  entered  into  the  Ten  Digit  Display 
then  the  Guidance  Message  "Invalid  Zone  Number  Selected" 
is  used. 

This  Control  has  no  effect  while  an  unacknowledged 
alarm  condition  exists.  The  ACKNOWLEDGE  control  will  con- 
tinue to  flash  for  attention.  Also,  if  attempts  are  made  to 
attach  Controls  to  a zone  that  is  experiencing  a communica- 
tion loss,  a warning  message  is  issued. 


Zone  Selected  Display  (O) 


The  Zone  Selected  Display,  figure  13,  is  a three 
digit  LCD.  It  identifies  to  the  GCS  Operator  the  number  of 
the  zone  to  which  the  switchable  Controls  are  attached.  This 
number  will  be  the  same  as  the  number  in  the  LCD  display 
(E)  associated  with  CCTV  Monitors  to  which  the  MPS  points. 


CCTV  Controls  (P,  Q,  R) 


Three  controls  are  provided  on  the  Console  to 
operate  those  assessment  cameras  which  are  fitted  with 
remote  control  facilities.  There  is  a single  Pan/Tilt/Zoom 
Control  (P) , figure  13,  and  two  individual  switches  (Q 
and  R) , figure  15,  for  operating  the  focus  and  iris  motors. 

The  Pan/Tilt/Zoom  Control  (P)  is  a "T"  shaped  con- 
trol with  three  degrees  of  freedom.  Pushing  it  straight  for- 
ward causes  the  camera  lens  to  zoom  in  making  it  appear  as 
though  the  camera  were  moving  closer  to  the  subject.  Pul- 
ling the  Control  straight  back  causes  the  lens  to  zoom  out 
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from  the  subject.  Rotating  the  top  of  the  Control  to  the 
left  or  right  causes  the  camera  to  pan  to  the  left  or  right 
respectively.  Rocking  the  top  of  the  Control  forward  causes 
the  camera  to  tilt  down.  Rocking  the  top  of  the  Control 
backwards  causes  the  camera  to  tilt  up.  The  hand  motions  on 


the  "T" 

simulate  the  motions  which 

would  be 

used  if  a 

cam- 

era  were 

held  in  the  Operators 

hand 

/ i.e. , 

pushing 

and 

pulling 

for  moving  close 

or 

away,  rotating  left 

and 

right  for 
back  for 

panning  left  and  right 
tilting  down  and  up. 

, and 

rocking 

forward 

and 

The 

Pan/Tilt/Zoom  Control 

is 

spring 

loaded 

and 

when  released  will  return  to  the  center,  neutral  position. 
This  causes  all  camera  motion  to  cease.  The  camera,  there- 
fore, will  remain  in  its  current  position  when  the  Control 
is  released  and  will  remain  in  that  position  until  inten- 
tionally moved. 


The  IRIS  (Q)  and  FOCUS  (R)  Controls,  figure  15, 
are  lighted,  three  position,  spring  loaded,  center  off 
switches.  These  switches  are  used  to  drive  the  motors  for 
these  functions.  Pushing  the  switch  causes  the  motor  to 
run  in  one  direction  while  pulling  causes  the  motor  to  run 
in  the  opposite  direction.  These  Controls  are  lighted 
when  there  is  an  operational  camera  equipped  with  these  re- 
mote controls  at  the  selected  zone. 


TV  OK/Bad  (S) 


This  Control,  figure  15,  is  a lighted,  three  position, 
spring  loaded,  center  off  switch.  It  is  used  by  the  Operator 
to  tell  the  System  when  a camera  at  the  currently  selected 
zone  is  malfuncting.  When  the  control  is  moved  into  the  BAD 
position,  the  System  is  informed  of  a malfuncting  camera. 
That  camera  is  then  considered  to  be  not  available.  The  CCTV 
Monitor  display  (F)  will  then  light  the  "NO  CAMERA"  legend. 
If  not  already  on,  the  white  Site  Status  Summary  Display 
legend  (I),  "REPAIRS  REQUIRED",  will  also  be  lighted.  In 
addition,  an  entry  will  be  made  in  the  DDU  status  display 
showing  the  time  and  the  zone  at  which  the  TV  has  been 
determined  to  be  malfunctioning. 

When  the  camera  has  been  returned  to  functional  status, 
that  fact  may  be  indicated  to  the  system  by  the  Operator 
moving  this  control  to  the  OK  position.  This  will  cause  the 
"TV  Bad"  entry  to  be  removed  from  the  DDU  status  display  and 
the  CCTV  Monitor  display  will  show  the  Operator  what 
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Figure  15.  Left-hand  control  group 

controls,  if  any,  are  available.  Also,  if  there  are  no  other 
devices  at  the  site  requiring  maintenance  then  the  white 
Site  Status  Summary  Display  legend,  REPAIRS  REQUIRED,  will 
be  turned  off. 

If  the  camera  at  the  selected  zone  is  already  in  the 
state  to  which  the  TV  OK/Bad  Control  is  being  pushed,  then 
nothing  will  occur.  If  there  is  no  camera  at  the  selected 
zone,  then  operation  of  this  control  will  have  no  effect. 
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Lights  On/Off  (T) 


This  Control,  figure  15,  is  a lighted,  three  posi- 
tion, spring  loaded,  center  off  switch.  It  is  used  by  the 
GCS  Operator  to  turn  the  lights  on  and  off  for  the  assess- 
ment camera (s)  at  the  selected  zone 


Voice  Of f /On/Repeat  (U) 


This  Control,  figure  15,  is  a lighted  three  posi- 
tion switch.  It  is  spring  loaded  in  the  REPEAT  posi- 
tion and  automatically  returns  to  the  center  or  ON  posi- 
tion. It  allows  the  Operator  to  have  the  last  voice  mes- 
sage that  was  output  repeated  by  pushing  the  Control  to 
the  REPEAT  position.  It  also  allows  the  Operator  to 
turn  off  the  Voice  Unit  by  placing  the  Control  in  the  OFF 
position.  The  Voice  Unit  may  then  be  returned  to  the  on 
state  by  placing  the  Control  in  the  ON  position.  When 
this  Control  is  in  the  OFF  position  the  light  is  also  turned 
off . 


Test  Controls  (V) 


These  Controls,  figure  15,  are  all  lighted  push 
switches.  Each  is  lighted  when  the  state  of  the  System  will 
allow  that  test  to  occur.  The  functions  of  these  Controls 
are  summarized  in  Table  3. 
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TABLE  3 


Test  Control  Functions 

Control 

Function 

FEDS 

This  Control  may  be  actuated  voluntarily  by 
the  Operator  or  in  response  to  a system 
request.  This  control  is  lighted  when  a zone 
is  selected  which  is  either  Secure  or  in 
Access.  Operation  causes  the  system  to 
sequentially  test  the  squib  bridgewire  and 
the  voltage  of  the  firing  battery  for  each 
FED  device  at  that  zone.  If  all  FEDS  test 
good,  then  a guidance  message  results.  If  a 
failure  results  then  the  guard  is  advised  to 
notify  maintenance  and  the  failure  message 
remains  on  the  Status  Message  Queue  until 
the  condition  is  corrected  and  the  FEDS  are 
retested . 

Sensors 

This  Control  may  be  actuated  voluntarily  by 
the  Operator  or  in  response  to  a system 
request.lt  is  lighted  when  no  unacknowledged 
alarm  conditions  exist  and  a valid  zone  has 
been  selected.  Operation  of  this  Control 
causes  the  system  to  sequentially  test  each 
Sensor  at  the  zone.  A Sensor  passes  the  test 
if,  when  a stimulus  is  applied  , it  goes 
from  the  quiet  to  the  alarmed  state,  and, 
when  the  stimulus  is  removed,  the  sensor 
returns  to  the  quiet  state.  If  all  Sensors 
pass  the  test,  a guidance  message  results. 
If  any  Sensor  fails,  then  the  Operator  is 
notified  and  advised  to  post  a guard  at  that 
zone  and  to  notify  maintenance.  Each  failed 
sensor  is  noted  as  a status  message  and 
remains  on  the  status  message  queue  until 
the  condition  is  corrected  and  the  Sensor 
passes  the  test. 

HQ  Link 

This  Control  transmits  a test  message  over 
each  of  the  redundant  data  links  to  higher 
headquarters.  If  the  messages  compare  then 
the  Link  is  considered  to  have  passed  the 
test  and  a Guidance  Message  results.  If  the 
messages  do  not  compare,  then  a message  goes 
on  the  status  message  queue,  and  remains 
until  the  condition  is  corrected  and  a 
successful  test  is  completed. 
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Indicators  This  Control  energizes  all  lamps  in  the 

Console  while  it  is  depressed. 

Sonic  Alarms  This  Control  causes  the  system  to  energize 

each  of  the  Sonic  Alarms  in  turn  for  a 
period  of  two  seconds. 


Login  and  Logout  (W  and  X) 


These  Controls,  figure  14,  are  lighted  push  switches. 
They  allow  the  Operator  to  either  Login  (W)  or  Logout 
(X)  of  the  System.  The  Operator  must  first  enter  the  correct 
identification  number  into  the  10-Digit  Display  via  the 
Keypad.  When  the  tenth  digit  has  been  entered,  the  lights  in 
these  two  Controls  begin  to  alternately  flash.  The  lights 
are  turned  off  when  either  of  these  Controls  is  actuated. 
The  identification  number  is  automatically  checked  for 
its  validity.  If  the  identification  number  is  correct  then 
the  Login  is  allowed.  Similarly  for  the  Logout,  except 
that  there  can  never  be  less  than  two  GCS  Operators  on  duty, 
and  the  Logout  will  not  be  allowed  if  this  situation 
results . 

Use  of  these  Controls  is  inhibited  if  there  are 
any  outstanding  unacknowledged  alarms.  Operation  of  ei- 
ther Control  while  in  this  state  will  cause  the  System 
to  reiterate  the  request  for  the  Operator  to  "Please  Ack- 
nowledge" . 


Scroll  Control  (Y) 


This  Control,  figure  14,  is  a lighted,  momentary  ac- 
tuated, spring  return  switch. 

The  site  status  messages  which  are  displayed  on  the 
DDU  may  not  fit  onto  a single  DDU  page.  Therefore,  they  are 
kept  in  a buffer  having  a capacity  of  more  than  one  page. 
This  Control  allows  the  information  in  the  buffer  to  be 
circularly  advanced  around  the  screen  of  the  DDU,  from  the 
bottom  towards  the  top. 

This  Control  is  lighted  when  the  DDU  buffer  con- 
tents exceeds  a single  page  of  information,  otherwise 
it  is  dark.  It  is  always  dark  when  site  status  information 
is  not  being  displayed. 
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Key  Life  (Z) 


This  Control,  figure  14,  is  a three-digit 
thumbwheel  switch.  It  is  used  to  set  the  time  interval,  in 
minutes,  during  which  an  Electronic  Key  is  valid.  The  least 
significant  position  is  fixed  at  zero,  so  that  the  minimum 
increment  is  ten  minutes.  This  value  will  be  loaded  into  an 
Electronic  Key  along  with  a random  number.  When  this 
time  interval  expires,  the  random  number  is  erased  from  the 
system. 


Code  Key  (AA) 


The  CODE  KEY  Control,  figure  14,  is  a lighted  push 
switch.  Actuation  of  this  Control  causes  a computer  gen- 
erated random  number  to  be  loaded  into  an  Electronic  Key, 
along  with  the  time  interval  from  the  Key  Life  Control  and 
the  number  of  the  zone  that  is  currently  selected. 

In  order  to  code  an  Electronic  Key  for  a particular 
zone,  the  Key  must  be  inserted  into  the  Key  Port  (G) , a 
non-zero  Key  Life  must  be  selected,  the  Lock/Enable  (EE) 
must  be  enabled,  the  switchable  Controls  must  be  attached 
to  the  desired  zone,  and  then  the  CODE  KEY  Control  actuated. 
Guidance  messages  are  presented  to  the  Operator  if  these 
conditions  are  not  met. 

The  CODE  KEY  Control  is  lighted  when  no  unack- 
nowledged alarm  conditions  exist  and  a valid  zone  is 
selected  for  which  an  Electronic  Key  does  not  already  exist. 
The  light  goes  out  when  a Key  is  successfully  loaded. 

An  Electronic  Key  loaded  in  this  manner  may  be  used 
only  once.  If  it  is  not  used  within  the  time  specified  by 
the  Key  Life  Control,  the  random  number  is  automatically 
erased  from  the  key  memory. 


Code  Master  Key  (BB) 

The  CODE  MASTER  KEY  Control,  figure  14,  is  a lighted 
push  switch.  Actuation  of  this  Control  causes  a computer 
generated  random  number  to  be  loaded  into  an  Electronic 
Key,  along  with  the  time  interval  from  the  Key  Life  Con- 
trol. An  Electronic  Key  loaded  in  this  manner  is  valid  for 
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any  zone  and  may  be  used  any  number  of  times  within  its 
lifetime . 

In  order  to  code  a Master  Electronic  Key,  the  Key  must 
be  inserted  into  the  Key  Port  (G) , a non-zero  Key  Life 
must  be  selected,  the  Lock/Enable  (EE)  must  be  enabled,  and 
then  the  CODE  MASTER  KEY  Control  actuated.  Guidance  mes- 
sages are  presented  to  the  Operator  if  these  conditions  are 
not  met. 

The  CODE  MASTER  KEY  Control  is  lighted  when  no 
unacknowlegded  alarm  conditions  exist  and  a Master  Electron- 
ic Key  does  not  already  exist.  The  light  goes  out  when 
a Key  is  successfully  coded. 


Send  Key  Control  (CC) 


The  SEND  KEY  Control,  figure  14,  is  a lighted  push 
switch.  Actuation  of  this  Control  causes  a previously 
generated  random  number  to  be  sent  to  the  currently  selected 
zone.  This  is  the  same  number  that  was  previously  loaded 
into  an  Electronic  Key  for  use  at  the  designated  zone  by 
operation  of  the  Code  Key  Control.  If  no  valid  Key  exists 
for  this  zone,  that  is,  no  Key  has  been  coded  or  a Key  has 
been  coded  but  its  lifetime  has  expired,  then  nothing 
happens  and  guidance  messages  are  provided  to  the 
Operator.  If,  at  the  zone,  the  random  number  in  the  Key 
matches  the  number  that  was  transmitted  to  that  zone,  then 
a bolt  is  withdrawn  from  a strike  and  the  door  to  the  zone 
is  unlocked.  When  the  key  is  inserted,  the  random  numbers 
in  both  the  Electronic  Key  and  computer  memory  are  erased  in 
order  to  limit  the  use  of  the  key  to  a single  time. 

The  SEND  KEY  Control  is  lighted  whenever  a zone  is 
selected  for  which  a valid  Electronic  Key  is  coded 
and  no  unacknowledged  alarm  conditions  exist. 


Send  Master  Key  Control  (DD) 


The  SEND  MASTER  KEY  Control,  figure  14,  is  a lighted 
push  switch.  Actuation  of  this  Control  causes  a previ- 
ously generated  random  number  to  be  sent  to  the  currently 
selected  zone.  This  is  the  same  number  which  was  pre- 
viously loaded  into  a Master  Electronic  Key  by  use  of  the 
CODE  MASTER  KEY  Control.  If  no  valid  Key  exists  that  is,  no 
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Key  has  been  coded  or  a Key  has  been  coded  but  its  lifetime 
has  expired,  then  nothing  happens  and  guidance  messages 
are  provided  to  the  Operator.  If,  at  the  zone,  the  random 
number  in  the  Master  Key  matches  the  number  that  was 
transmitted  to  that  zone,  then  a bolt  is  withdrawn  from  a 
strike  and  the  door  to  the  zone  is  unlocked.  Whether  or  not 
a match  occurs,  the  random  numbers  are  not  erased.  This  way 
the  Master  Key  may  be  used  again  either  at  the  same  zone  or 
at  another  zone. 

The  SEND  MASTER  KEY  Control  is  lighted  whenever  a 
valid  Master  Electronic  Key  is  coded  and  no  unack- 
nowledged alarm  conditions  exist. 


Lock/Enable  Control  (EE) 


This  Control,  figure  14,  is  a keyed  two  position 
switch.  In  order  for  the  CODE  KEY  and  CODE  MASTER  KEY 
Controls  to  be  functional  this  Control  must  be  in  the  Enable 
position.  Guidance  messages  are  provided  to  the  Operator 
when  either  the  CODE  KEY  or  CODE  MASTER  KEY  is  actuated 
while  this  Control  is  in  the  Lock  position. 


Call  BAF  (GG)  and  Call  ARF  & BAF  (FF ) 


These  controls,  figure  13,  are  lighted  push 
switches.  They  are  the  means  by  which  the  Operator 
may  call  out  reinforcements  to  cope  with  an  emergency  si- 
tuation. BAF  is  the  back  up  force  of  off  duty  guards  on  or 
adjacent  to  the  exclusion  area.  ARF  is  an  augmentation 
force  located  at  higher  headquarters.  When  ARF  is  called, 
BAF  is  automatically  called.  However  BAF  may  be  called 
without  ARF.  When  either  of  these  Controls  is  actuated  a 
three  step  sequence  of  sonic  alarms  is  initiated.  This  is 
the  same  sequence  which  is  initiated  by  a new  alarm  condi- 
tion. Also,  the  CONFIRM  (KK)  and  CANCEL  (LL)  Controls 
flash  alternately. 

Acutation  of  the  CONFIRM  Control  terminates  the 
sonic  alarm  sequence  and  causes  the  immediate  execution  of 
the  CALL  BAF  or  the  CALL  ARF  & BAF  request.  The  CONFIRM 
Control  also  opens  a voice  communication  link  between  the 
Operator  and  the  BAF  area  so  that  the  Operator  may  provide 
the  BAF  forces  with  instructions  or  directions  relative  to 
the  emergency  situation. 
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Actuation  of  the  CANCEL  Control  terminates  the  sonic 
alarm  sequence  and  cancels  the  CALL  BAF  or  the  CALL  ARE  & 
BAF  request.  In  this  manner  an  accidental  actuation  of  these 
Controls  may  be  cancelled 

If  neither  CANCEL  or  CONFIRM  Controls  have  been  ac- 
tuated when  the  alarm  sequence  times  out  in  40  seconds, 
then,  automatic  callout  occurs.  This  action  is  based  on  the 
assumption  that  the  Operator  would  actuate  one  of 
these  Controls  unless  incapacitated. 

In  the  event  that  a new  alarm  condition  should  oc- 
cur during  the  sonic  alarm  sequence,  then,  in  addition  to 
the  CANCEL  and  CONFIRM  Controls,  the  ACKNOWLEDGE  Control 
will  begin  to  flash.  Actuation  of  the  ACKNOWLEDGE 
Control  or  the  Monitor  Pointing  Switch  will  acknowledge 
the  new  alarm.  Termination  of  the  sonic  alarm  sequence 
is  only  accomplished  by  use  of  the  CANCEL  or  the  CONFIRM 
Controls.  During  the  new  alarm  condition  use  of  either 
the  CANCEL  or  the  CONFIRM  Controls  will  not  only  do  their 
normal  functions  but  also  do  the  acknowlegdment  of  the  new 
alarm. 

The  rational  for  this  is  that  the  purpose  of  the  ack- 
nowlegdment is  to  provide  evidence  to  the  system  that  the 
Operator  has  not  been  incapacitated.  Use  of  the  CANCEL 
or  CONFIRM  Controls  provides  this  evidence. 


Arm  FEDS  Control  (HH) 


This  Control,  figure  13,  provides  the  first  of  three 
step  in  the  sequence  to  remotely  fire  the  FEDS.  Actuation 
of  this  control  will  cause  the  FIRE  FEDS  (JJ)  and  the  SAFE 
FEDS  (II)  to  begin  to  alternately  flash.  The  ARM  FEDS 
Control  is  lighted  when  a zone  is  selected  that  is  in  the 
alarm  acknowledged  state  and  the  FEDS  have  not  previously 
been  either  armed  or  fired. 


Safe  FEDS  (II) 


This  control,  figure  13,  causes  the  FEDS  to  be  returned 
to  the  unarmed  state.  It  flashes  alternately  with  the 
FIRE  FEDS  Control  when  the  ARM  FEDS  Control  has  been  proper- 
ly used.  Operating  it  at  any  other  time  will  have  no  ef- 
fect and  guidance  messages  will  be  provided  to  the  Operator. 
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Fire  FEDS  (JJ) 

This  Control,  figure  13,  is  the  second  of  three  steps 
in  the  sequence  to  remotely  fire  the  FEDS.  It  flashes  al- 
ternately with  the  SAFE  FEDS  Control  when  the  ARM  FEDS  Con- 
trol has  been  properly  used.  Actuation  of  this  Control 
causes  the  CANCEL  and  CONFIRM  Controls  to  flash  alternately. 
Use  of  this  Control  any  time  other  than  when  it  flashes 
will  have  no  effect  and  guidance  messages  will  be  provided 
to  the  Operator. 

If  the  FIRE  FEDS  Control  had  been  used  then  the  CON- 
FIRM Control  is  the  third  and  final  step  in  the  sequence 
to  remotely  fire  the  FEDS.  All  steps,  in  the  sequence  must 
be  taken  in  the  proper  order  to  fire  the  FEDS;  select 
a valid  zone.  Arm  FEDS,  Fire  FEDS  , and  Confirm.  If,  at  any 
point  in  the  sequence,  the  Operator  selects  another  zone  and 
then  returns  to  the  original  zone,  then  the  sequence  contin- 
ues from  where  it  was  when  the  original  zone  was  selected. 
That  is,  attaching  to  another  zone  does  not  return  the  FEDS 
at  the  original  zone  to  the  safe  state. 


Confirm  (KK)  and  Cancel  (LL) 


These  controls,  figure  13,  flash  alternately  when  the 
FIRE  FEDS  or  the  CALL  BAF  or  the  CALL  ARF  & BAF  Controls  are 
properly  operated.  Their  use  to  confirm  or  cancel  these 
commands  has  already  been  described. 


Reset  Alarm  (MM) 


The  RESET  ALARM  control  is  shown  in  figure  13.  This 
control  is  used  to  restore  a zone  to  the  Secure  condition 
when  an  access  condition  is  terminated,  or  after  conditions 
causing  a sensor  to  alarm  have  been  quieted.  In  addition, 
if  an  Alarm  State  is  present  and  the  use  of  the  TEST  SENSORS 
control  shows  that  the  sensor  causing  the  alarm  has  failed, 
then,  use  of  the  RESET  ALARM  control  will  restore  the  zone 
to  a Secure  State.  Prior  to  restoring  the  zone  to  the 
Secure  State  under  such  circumstances,  the  Operator  must  in- 
sure that  a guard  has  been  posted  at  that  zone. 

If  there  is  no  Unacknowledged  Alarm  condition  present, 
then  the  RESET  ALARM  control  is  lighted  when  the  selected 
zone  is  in  either  the  Access  or  Alarm  States. 
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When  this  control  is  successfully  used,  the  zone  is  re- 
moved from  the  alarm  queue  and  the  alarm  messages  are  re- 
placed by  status  messages  on  the  DDU. 


Date  Display  (NN) 


A four  digit  display  of  the  current  date  as  is  shown  in 
figure  11.  The  first  two  digits  represent  the  month.  These 
are  separated  by  a colon  from  the  second  two  digits  which 
show  the  day  of  the  month. 


Time  Display  (00) 


Directly  below  the  date  display,  a six  digit  display 
shows  the  current  time  in  hours,  minutes,  and  seconds  on  a 
24-hour  basis.  This  is  shown  in  figure  11. 


GCS  HARDWARE  DESCRIPTION 


In  the  following  sections,  some  of  the  specially 
designed  or  modified  hardware  components  of  the  GCS  simula- 
tor are  described. 
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Console  Processor  Interface  Boards 


The  Console  Processor  in  the  GCS  contains  six  parallel 
line  interface  boards  and  one  serial  line  interface  board 
with  four  ports.  The  parallel  line  outputs  drive  the  lamps, 
alarms,  digital  readouts,  and  the  video  switches;  the  paral- 
lel inputs  are  connected  to  the  console  switches.  The  seri- 
al line  ports  interface  the  Console  Terminal,  DDU,  Voice 
Unit,  and  the  Event  Processor  (download  link)  to  the  Console 
Processor.  An  additional  parallel  line  interface  was  modi- 
fied specifically  to  communicate  with  the  Event  Processor  at 
a higher  data  rate  than  is  possible  with  the  serial  download 
link . 


A 60  Hz  line  clock  is  available  in  the  Console  Proces- 
sor for  timing  and  synchronization.  It  is  not  configured  as 
an  I/O  device  (not  addressable,  therefore  not  programmable) 
but  is  connected  directly  to  an  interrupt  line  reserved  for 
that  purpose. 


GCS  Special  Interface  Boards 

To  connect  the  GCS  hardware  to  the  Console  Processor, 
parallel  line  interface  boards  requires  a variety  of  cir- 
cuits for  decoding,  driving,  debouncing,  etc.  This  circui- 
try is  located  on  10  special-purpose  logic  boards  mounted  in 
a card  file  in  the  left  pedestal  of  the  GCS  adjacent  to  the 
Processor.  Cables  from  the  parallel  line  interfaces  connect 
to  these  boards  as  do  cables  from  the  six  console  panels, 
thus  this  card  file  serves  as  a junction  box  for-’signal  ca- 
bles with  signal  routing  done  on  the  boards  and  on  the  card 
file  backplane.  The  10  logic  cards  are  of  the  following 
types : 

Switch  Debounce  (2  each) 

Lamp  Drivers  (3  each) 

LCD  Decoder/Drivers  (3  each) 

Keypad/lO-digit  Display  Interface  (2  each) 
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Switch  Debounce 


The  pushbutton  and  lever  switches  on  the  Console  re- 
quire debouncing  circuits  so  that  one  actuation  is  not 
misinterpreted  as  several  due  to  contact  bounce.  This  is 
accomplished  by  connecting  each  switch  to  a latch  (RS  flip- 
flop)  ; the  latch  is  set  upon  closure  of  the  normally-open 
switch  contacts  and  is  unaffected  when  these  contacts  bounce 
open.  The  latch  is  reset  by  the  normally-closed  contact 
pair  when  the  switch  is  released  and,  again,  the  latch  is 
not  affected  by  bounce.  Note  that  double-throw  switches  are 
required  for  this  technique.  The  latch  outputs  are  tied 
directly  to  the  inputs  of  the  parallel  line  interface 
boards,  one  line  (bit)  per  switch. 


Lamp  Drivers 

There  are  two  incandescent  lamps  in  each  indicator  and 
each  illuminated  switch.  Each  lamp  requires  180  milliam- 
peres  of  current  at  5 volts.  Since  this  is  far  more  than 
the  current  drive  capability  of  the  parallel  line  interface 
outputs,  lamp  driver  circuits  are  required.  The  lamp  driver 
chips  that  are  used  have  a 2-input  OR-gate  in  front  of  each 
driver  circuit  which  facilitates  the  implementation  of  a 
hardwired  lamp  test  feature.  One  input  of  each  gate  is  tied 
to  an  output  of  a parallel  line  interface  board;  the  remain- 
ing inputs  are  tied  together  and  driven  by  the  TEST  INDICA- 
TORS function  switch  so  that  the  lamps  are  all  turned  on 
when  this  switch  is  depressed. 

Power  for  the  lamps  comes  from  a 5 volt,  25  ampere  sup- 
ply. In  order  to  minimize  the  power  surge  through  the  sys- 
tem cabling  when  all  lamps  are  simultaneously  turned  on  (as 
in  TEST  INDICATORS)  the  lamps  are  biased  to  nearly  glowing 
when  in  the  OFF  state.  This  is  done  by  connecting  a 31  ohm 
resistor  to  each  lamp  pair  in  parallel  with  the  lamp  driver. 
This  has  two  effects  which  reduce  the  step  increase  in 
current:  (a)  the  power  supply  is  pre-loaded  to  more  than 
50%  of  its  peak  load,  and  (b)  the  lamp  filaments  are  pre- 
heated which  increases  their  resistance.  This  reduces  in- 
rush current  when  the  lamp  is  turned  on.  The  lamps  are  rat- 
ed for  6.3  volt  operation  and  running  them  at  only  5 volts 
greatly  increases  their  life  expectancy. 
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LCD  Decoder/Drivers 


The  liquid  crystal  displays  (LCD's)  are  one-half  inch 
high,  seven-segment  digits  with  four  or  six  digits  per 
display  package.  To  drive  each  segment  individually  from 
the  Processor  ports  would  require  a very  large  number  of 
lines  (bits),  that  is,  seven  times  the  number  of  digits. 
Therefore,  decoder/dr iver  integrated  circuits  are  used  which 
require  only  four  input  lines  per  digit.  Still,  to  drive 
the  19  digits  the  GCS  uses  would  take  76  bits  of  parallel 
port  output,  a formidable  number.  A further  reduction  is 
accomplished  by  using  a multiplexing  scheme.  This  scheme 
requires  only  16  bits  for  data  plus  6 bits  to  select  the 
display  to  be  set  or  updated.  The  decoder/dr iver  chips  con- 
tain latches  for  the  data  and  all  the  driver  circuits  neces- 
sary for  supplying  the  required  waveforms  to  the  LCD  back- 
planes and  segments. 


Keypad/lO-digit  Display 

The  12  keys  of  the  keypad  are  not  interfaced  to  the 
Console  Processor  through  the  parallel  ports.  Since  the 
keypad  output  is  always  directed  to  the  10-digit  display,  it 
has  been  hardwired  for  that  function.  Eleven  of  the 
single-pole,  single-throw  switches  on  the  keypad  are  de- 
bounced  and  then  encoded  to  four  lines.  These  four  lines 
feed  a 10  X 4-bit  shift  register.  As  each  key  is  depressed, 
its  number  is  entered  into  the  rightmost  digit  position  of 
the  register,  causing  previous  entries,  if  any,  to  shift  to 
the  left.  When  the  register  is  full  (10  digits  entered)  a 
FULL  status  signal  is  asserted  at  one  of  the  parallel  ports. 

The  Processor  reads  one  digit  at  a time;  the  leftmost 
digit.  This  causes  the  string  to  shift  left  one  position, 
with  blank  spaces  coming  in  on  the  right  end.  The  process 
of  read/shift  is  repeated  until  the  register  is  empty  (all 
blanks) . 

The  eleventh  key  on  the  pad,  labeled  inserts  a 

symbol  in  the  display,  but  this  capability  is  not  normally 
used.  The  remaining  (12th)  key  on  the  keypad  is  used  to 
manually  clear  the  register.  This  is  used  when  the  operator 
realizes  he  has  made  an  erroneous  entry.  The  clear  key  is 
not  decoded;  it  simply  forces  the  code  for  "blank"  into  all 
digit  positions. 
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The  contents  of  the  shift  register  is  at  all  times 
displayed  by  the  10-digit  LCD  display.  Non-latching 
decoder/dr iver  circuits  translate  the  four-line  codes  in  the 
shift  register  to  the  seven-segment  LCD  digits. 

For  error  conditions,  the  display  can  be  placed  in  a 
special  mode  which  causes  it  to  flash  a pattern  of  dashes 

( ).  Upon  receipt  of  an  ERROR  command  from  the 

Processor,  codes  for  "blank”  and  are  alternately  forced 
into  all  stages  of  the  shift  register  at  a rate  of  about  2 
Hz.  The  flashing  continues  until  the  Processor  clears  the 
ERROR  bit  or  the  CLEAR  key  is  depressed. 


Monitor  Pointing  Switch 

The  Monitor  Pointing  Switch  (MPS)  is  a large  2-position 
switch  designed  to  give  unambiguous  and  rapid  switching  of 
CCTV  displays  and  associated  controls.  Reliable  electrical 
switching,  positive  mechanical  action,  and  large  actuator 
size  are  the  prime  requisites  of  this  custom  designed 
switch . 

Electrical  switching  is  done  with  optical  switches  in- 
stead of  mechanical  contacts.  Each  optical  switch  consists 
of  an  LED  source  and  photo-transistor  detector  molded  into  a 
U-shaped  package.  A flange  on  the  underside  of  the  MPS 
passes  through  the  "U"  to  obstruct  or  pass  the  light  beam 
according  to  the  position  of  the  switch.  Two  optical 
switches  are  used  for  each  position  for  redundancy;  the  out- 
puts of  the  detectors  are  OR-gated  so  that  one  failure  will 
not  cause  the  MPS  to  be  inoperative. 

Outputs  from  the  MPS  to  the  Console  Processor  consist 
of  three  bits:  MPS  LEFT,  MPS  RIGHT,  and  MPS  MOVED.  The  MPS 
MOVED  bit  is  asserted  by  motion  in  either  direction  and  is 
cleared  when  the  Processor  reads  that  information.  Connec- 
tions to  the  parallel  interface  lines  of  the  Processor  are 
made  via  one  of  the  switch  debounce  boards. 
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CCTV  Subsystem 


The  CCTV  Subsystem  employes  commercial  525  line  resolu- 
tion, black  and  white  camera  and  monitor  equipment.  In  vir- 
tually all  other  respects,  however,  the  system  described 
below  is  quite  different  from  what  would  be  installed  at  an 
actual  site.  A site  with  a large  number  of  cameras  would 
require  a more  sophisticated  Video  Switcher  and  would  employ 
video  transmission  and  camera  control  arrangements  of  the 
sort  described  in  Reference  1. 


Cameras 

In  this  simulation,  four  CCTV  cameras  are  used  in  the 
alarm  assessment  system.  Three  are  stationary,  fixed  lens 
cameras;  the  fourth  is  mounted  on  a pan/tilt  head  and  has  a 
zoom  lens  with  controllable  iris  and  focus  adjustments. 


Video  Switcher 

The  video  signals  from  the  cameras  are  connected  to  the 
monitors  by  the  Video  Switcher.  Switching  is  accomplished 
through  reed  relays  that  are  in  turn  controlled  by  the  Con- 
sole Processor  through  one  of  the  parallel  line  ports.  Two 
bits  of  the  parallel  port  are  assigned  to  each  video  signal 
to  select  left  or  right  display.  The  Processor,  using 
internal  information  and  the  Monitor  Pointing  Switch  posi- 
tion, actuates  the  appropriate  relay(s).  The  top/bottom  as- 
signment is  hard-wired  since  this  depends  on  the  number  of 
cameras  per  zone.  For  two-camera  zones  the  video  from  the 
camera  with  the  longer  focal  length  is  switched  only  to  top 
monitors;  all  other  video  is  switched  to  bottom  monitors. 


Camera  Controls 

Pan,  tilt,  and  zoom  control  for  the  camera  equipped 
with  those  features  is  done  via  a special  handgrip  style 
control.  Electrically,  the  Pan/Tilt/Zoom  Control  consists 
of  optical  switches,  two  switches  for  each  control  axis. 
Each  optical  switch  has  a light  source  and  a detector  molded 
into  one  package.  The  light  paths  of  the  switches  are  all 
obstructed  when  the  control  is  in  the  rest  position;  actua- 
tion allows  light  to  pass  in  the  selected  switch.  With  this 
design,  failure  of  a light  source  will  not  result  in  unin- 
tended motion  of  the  camera. 
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Control  of  lens  iris  and  focus  is  provided  for  by  two 
3-position  lever  switches  mounted  on  the  lower  left  panel. 
These  are  conventional  hard  contact  switches. 


Camera  Motor  Drive 

The  controllable  CCTV  hardware  used  in  this  simulation 
is  part  of  a commercial  area  surveillance  system  that  has 
been  adapted  for  this  application.  The  original  control 
module  is  mounted  in  the  right  pedestal  of  the  GCS . The  GCS 
camera  controls  are  connected  through  relays  to  this  control 
module;  the  control  module  is  in  turn  cabled  to  the  camera. 
The  control  module  contains  the  required  power  supplies  of 
165  volts  and  + and  -70  volts  DC.  It  is  designed  to  drive 
camera  positioning  equipment  at  distances  up  to  3000  feet. 


Voice  Unit 

The  Voice  Unit  in  the  GCS  is  a stored  vocabulary  speech 
response  device  that  synthesizes  utterances  from  encoded, 
compressed  speech  data  that  has  been  stored  in  read-only 
memory  (ROM) . The  vocabulary  has  been  selected  for  the  ap- 
plication and  is  sufficient  to  annunciate  all  the  messages 
that  are  printed  on  the  DDU. 

The  Voice  Unit  is  computer  controlled  through  the  use 
of  word  pointer  and  commands.  Word  pointers  specify  which 
utterance  should  be  spoken;  commands  are  used  to  instruct 
the  unit  to  change  pitch,  select  frame  rate,  set  inter- 
utterance delay,  etc.  Commands  and  word  pointers  are  ar- 
ranged in  the  desired  sequence  by  the  computer  program  and 
downloaded  to  a buffer  in  the  Voice  Unit  via  a serial  I/O 
port.  Once  they  have  been  downloaded,  a microcontroller  in 
the  unit  retrieves  the  encoded  speech  data  from  ROM  and 
presents  it  to  the  speech  synthesizing  circuits  that  gen- 
erate the  digital  representation  of  the  original  speech 
waveform.  A digital-to-analog  converter  then  transforms 
this  representation  into  its  analog  counterpart  which  is  am- 
plified and  fed  to  a conventional  8 ohm  speaker. 

The  vocabulary  may  be  changed  or  added  to  by  changing 
or  adding  ROM  chips.  Seven  28-pin  ROM  sockets  are  available 
to  the  user.  These  sockets  accept  16,  32,  or  64  kilobit 
ROMs,  thus  the  vocabulary  memory  may  range  from  16  kilobits 
to  448  kilobits.  (One  second  of  speech  requires  about  2.2 
kilobits  of  memory.)  The  present  implementation  uses  all 
seven  ROM  sockets  for  a total  of  248  separate  utterances. 
These  utterances  include  226  discrete  words,  11  prefixes  and 
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suffixes,  2 phrases  of  5 words  each,  and  4 tones.  Not  all 
ROMs  are  utilized  to  capacity  because  the  vocabulary  was  or- 
dered in  increments  as  the  system  was  developed  instead  of 
as  a single  unit.  For  example,  one  ROM  contains  just  two 
phrases  (in  German) ; this  was  done  to  demonstrate  the 
multi-lingual  capabilities  of  the  unit. 


Sonic  Alarms 

Three  audible  alarms  are  provided.  They  were  selected 
so  that  each  is  easily  distinguishable  from  the  other.  Two 
are  solid  state  audio  devices;  one  gives  a 2900  Hz  pulsating 
sound  and  the  other  a 4500  Hz  continuous  tone.  The  third 
device  is  a conventional  buzzer.  The  alarms  are  driven  from 
one  of  the  parallel  ports  of  the  Console  Processor  in  the 
same  manner  as  the  lamps,  i.e.,  one  bit  of  the  port  drives 
each  device  through  a current  driver  circuit.  All  of  the 
devices  are  mounted  on  the  upper  left  panel  of  the  GCS. 


Console  Shell 

The  cabinetry  for  the  GCS  has  been  designed  for  flexi- 
bility of  device  placement  in  order  to  facilitate  experi- 
ments in  the  layout  of  controls  and  displays.  The  Console 
consists  of  an  upper  plywood  shell,  with  cutouts  for  panels 
and  shelves  for  TV  monitors.  It  rests  on  two  short  equip- 
ment racks  which  serve  as  pedestals. 

The  plywood  shell  is  34  inches  long  by  68  inches  deep. 
The  lower  portion,  sloped  15  degrees  from  the  horizontal 
plane,  has  a long  cutout  designed  to  accept  three  11.5  x 20 
inch  metal  panels.  The  upper  portion,  sloped  15  degrees 
from  the  vertical  plane,  has  five  recessed  shelves  for 
placement  of  the  four  CCTV  monitors  and  the  DDU.  Shelves 
are  used  here  instead  of  rigid  mounting  devices  to  facili- 
tate experiments  with  angular  and  depth  positioning  of  these 
units.  In  addition  to  the  shelves,  there  are  cutouts  for 
three  metal  panels:  8 x 24  inch  panels  on  either  side  of 
the  shelf  area  and  a 5 x 18  inch  panel  at  top  center.  All 
exterior  surfaces  of  the  plywood  shell,  including  the  re- 
cessed shelves,  are  covered  with  Formica. 

The  pedestals  are  stock  equipment  racks,  26  inches 
high,  22  inches  wide,  and  28  inches  deep.  The  internal 
mounting  space  accepts  standard  19  inch  wide  panels.  The 
left  pedestal  houses  the  Console  Processor,  the  card  file 
for  the  special  GCS  interface  boards,  and  two  power 
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supplies.  The  Processor  is  mounted  on  chassis  slides;  the 
card  file  is  mounted  to  the  front  rails  above  the  Processor, 
The  power  supplies  are  attached  to  the  rear  rails.  The 
right  pedestal  contains  the  Voice  Unit,  Video  Switcher,  and 
Camera  Motor  Drive, 


Cabling 

GCS  internal  cabling  is  designed  around  a modular  con- 
cept for  ease  of  assembly  and  maintenance.  Each  panel  may 
be  lifted  out,  quickly  disconnected,  and  completely  removed 
from  the  console.  All  signal  connections  are  made  via  flat 
cables;  cable  ends  have  crimp-on  insulation  displacement 
connectors.  DC  power  (+5  volts)  is  brought  to  each  panel 
via  a locking  circular  connector  which  accepts  up  to 
14-guage  wire. 


Power  Supplies 

Five  volt  DC  power  is  required  for  the  special  inter- 
face boards  and  for  the  lamps.  Since  the  lamp  power  supply 
is  subject  to  large  step  changes  in  load  it  is  inadvisable 
to  run  the  lamps  and  interface  boards  from  the  same  supply. 
Hence,  two  supplies  are  used,  a 25  ampere  switching  supply 
for  the  lamps  and  a 3 ampere  linear  supply  for  the  interface 
boards.  The  Processor  and  other  packaged  units  such  as  the 
Voice  Unit,  CCTV  cameras,  etc.,  have  their  own  internal  DC 
supplies . 


SIMULATION  SOFTWARE 


For  the  sake  of  expediency  and  economy,  the  selection 
of  hardware  and  software  was  based  on  availability  and  fami- 
liarity rather  than  optimization  of  function  and  speed.  The 
hardware  used  existing  available  DEC  LSI  11/23  [*] 


[*]  Certain  commercial  equipment,  instruments,  or  ma- 
terials are  identified  in  this  paper  in  order  to  ade- 
quately specify  the  experimental  procedure.  Such  iden- 
tification does  not  imply  recommendation  or  endorsement 
by  the  National  Bureau  of  Standards,  nor  does  it  imply 
that  the  materials  or  equipment  identified  are  neces- 
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processors.  The  software  was  written  in  the  C language  [3] 
(and  some  assembly  language  where  necessary) . The  UNIX 
operating  system  served  as  the  development  system  environ- 
ment, and  was  also  used  for  part  of  the  run  time  environ- 
ment. 


Software  Design 


Three  cooperating  processes  were  the  basis  of  the 
software  design.  One,  the  Console  Process,  was  to  service 
the  console  inputs  and  outputs,  and  the  second,  the  Event 
Process,  was  to  service  and  maintain  the  history  of  events 
from  the  individual  zones  via  the  C.U.  and  from  the  Console 
Process.  A third  process,  the  Director  Process,  was  also 
required  to  coordinate  events  and  simulate  the  actions  that 
could  occur  at  the  various  zones. 

Each  process  was  to  be  placed  on  a separate  processor, 
primarily  because  the  processors  available  had  a limited  per 
process  address  space  (56K  by tes/process) . Also,  project 
requirements  specified  that  the  Console  be  polled  rather 
than  interrupt  driven,  to  increase  speed  and  avoid  operating 
system  overhead.  Placing  each  process  on  a separate  proces- 
sor allowed  the  Console  Process  to  run  stand-alone  in  a pol- 
ling mode,  while  the  other  processes  could  be  run  under  an 
interrupt  driven  operating  system.  This  was  possible,  for 
this  feasibility  model  only,  since  time  was  not  as  critical 
for  these  other  processes.  The  Director  Process  was  placed 
on  a third  processor,  mainly  so  as  not  to  interfere  with  or 
delay  the  other  processes. 

The  additional  communication  overhead  between  the  pro- 
cessors was  more  than  offset  by  the  gain  in  speed  with 
parallel  processing.  The  communication  between  the  three 
processes  was  designed  to  be  message  based,  with  an  extensi- 
ble message  set.  It  was  inplemented  on  a 16  bit  parallel 
port  for  speed,  approximately  40K  bytes/sec. 


sarily  the  best  available  for  the  purpose. 
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The  Console  Process 


The  Console  Process  is  a combination  of  a minimum 
operating  system  and  an  application  program  running  on  a 
bare  processor.  It  functions  mainly  as  an  intelligent  dev- 
ice driver.  It  samples  the  state  of  the  console  switches, 
processes  any  change  in  their  state,  exchanges  messages  with 
the  Event  Process,  and  updates  the  console  display  lights  to 
reflect  current  operational  conditions.  Messages  are  ex- 
changed to  inform  the  Event  Process  of  any  state  changes,  as 
well  as  accepting  information  on  current  operational  condi- 
tions from  the  Event  Process.  The  Console  Process  also 
maintains  an  abbreviated  status  record  about  the  overall 
site  and  the  currently  attached  zone,  if  any.  Formatted  DDU 
messages,  generated  by  the  Event  Process,  are  stored  and 
displayed  as  necessary  by  the  Console  Process.  The  software 
organization  of  the  Console  Process  is  shown  in  figure  16, 
where  each  box  represents  a module.  The  device  drivers, 
scheduler,  and  clock  modules  handle  the  necessary  operating 
system  features  in  this  polling  environment.  The  remaining 
modules  handle  the  various  application  features.  The  only 
requirement  placed  on  a module  is  that  once  it  starts  exe- 
cuting it  completes  its  designated  function. 


The  Scheduler 

In  this  organization  the  execution  flow  is  controlled 
by  a table  driven  scheduler  which  continually  polls  each  ap- 
plication module  in  sequence.  The  individual  modules  deter- 
mine if  there  is  any  work  for  them  to  do,  and  at  completion 
return  a result  indicator  to  the  scheduler.  Based  on  the 
result  indicator  the  scheduler  determines  if  one  or  more  of 
the  next  sequential  application  modules  should  be  skipped 
during  this  round  of  polling.  After  the  polling  of  any  ap- 
plication module  the  device  driver  module  is  always  polled 
next.  Thus,  in  effect  interleaving  the  device  driver  module 
between  each  application  module. 


The  Device  Driver 

This  module  handles  the  details  of  getting  data  between 
the  buffers  and  the  individual  devices  (DDU,  Logging 
Printer,  Voice  Unit,  and  Communication  Channel  - inbound  and 
outbound) . Each  device  is  allocated  a dedicated  circular 
buffer.  The  inbound  communication  channel  acts  as  a 
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Figure  16.  Block  diagram  of  the  Console  Process 

producer  function,  filling  its  buffer,  while  for  all  the 
other  devices  the  drivers  act  as  a consumer  function,  empty- 
ing their  buffers. 
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The  Clock 


This  module,  which  is  a combination  of  operating  system 
and  application  function,  is  the  only  exception  to  the  non- 
interrupt requirement.  This  is  strictly  due  to  the  archi- 
tecture of  the  processor  which  had  no  programmable  interface 
tc  the  hardware  clock.  Therefore,  in  this  case  an  interrupt 
was  the  only  means  of  determining  when  a clock  tick  had  oc- 
cured.  The  operating  system  function  of  this  module  is  to 
keep  track  of  the  current  time.  The  application  function  of 
this  module  is  to  update  the  console  date  and  time  LCD 
display  each  second  and  maintain  various  other  application 
required  time  durations. 


The  Massage  Handler 

This  application  module  processes  all  incoming  messages 
from  the  Event  Process  and  then  removes  them  from  the  incom- 
ming  message  buffer.  The  list  of  messages  between  the  Con- 
sole and  Event  Processes  are  shown  in  figures  17  and  18, 
along  with  their  parameters.  The  incoming  messages  of  fig- 
ure 13  fall  into  two  general  categories:  (1)  update  the 
current  abreviated  site  or  attached  zone  status,  and  (2) 
process  a device  request  (i.e.,  add  or  delete  a formatted 
DDU  message,  execute  a formatted  voice  message,  etc.).  If 
the  current  message  is  not  concerned  with  the  DDU,  then  the 
DDU  Manager  and  DDU  Updater  module  are  skipped  during  this 
polling  cycle. 
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TABLE  4 


List  of  Messages  from  Console  Process  to  Event  Process 


Message  format: 


size  in 

command 

command 

bytes 

type 

number 

parameters  

2 bytes 

1 byte  1 byte 

n bytes 

COMMAND  TYPE 

COMMAND  NO. 

PARAMETERS 

request 

0 

- 

date  and  time 

- 

info 

1 

- 

valid  zone  list 

- 

2 

- 

zone  status 

zone  # 

6 

- 

alarmed  status 

- 

9 

— 

site  status 

— 

send 

0 

— 

date  and  time 

date,  time 

info 

2 

- 

zone  status 

zone  status 

3 

- 

CCTV  for  zone  # 

zone  # , ok/bad 

4 

- 

lights,  zone  # 

zone  # , on/off 

7 

- 

set  FEDS  state 

zone  #,  safe/arm/f ire 

8 

— 

acknowledge 

— 

guard 

0 

- 

login 

ID  # 

action 

1 

- 

logout 

ID  # 

3 

- 

code  key 

zone#,  key#,  key  life 

4 

— 

code  master 

key#,  key  life 

test 

0 

— 

test  FEDS 

zone  # 

request 

1 

- 

test  sensors 

zone  # 

2 

— 

test  HQ  links 

— 

request 

0 

— 

BAF 

zone  #,  guard/automatic 

help 

1 

- 

ARF 

zone  #,  guard/automatic 

2 

— 

restore 

— 

access 

0 

— 

access 

zone# 

1 

- 

master  access 

zone# 

2 

- 

clear  access 

zone# 

3 

- 

clear  master 

access 

zone# 

4 

- 

secure 

zone# 

6 

- 

check  key  life 

- 
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TABLE  5 


List  of  Messages  from  Event  Process  to  Console  Process 
Message  format: 


size  in 

command 

command 

bytes 

type 

number 

parameters 

2 bytes 

1 byte 

1 byte 

n bytes 

COMMAND  TYPE  COMMAND  NO.  PARAMETERS 


request 

info 

send 

info 


guard 

test 

access 

results 


logg ing 
message 

DDU 

message 


voice 

message 


0 - 
2 - 

0 - 
1 - 
2 - 
6 - 
9 - 
10  - 

11  - 

0 - 

2 - 

0 - 
1 - 
2 - 

3 - 

4 - 

5 - 

0 - 
1 - 

0 - 
1 ~ 
2 - 

3 - 

4 - 

5 - 

6 - 
7 - 

0 - 
1 - 


date  and  time 
zone  status 

date  and  time 
valid  zone  list 
zone  status 
alarm  zone  status 
site  status 
communication 
failure 
alarm 

identity  valid 

HQ  link 

regular  key 
master  key 
clear  access 
clear  master 
go  secure 
continue  alarm 

status 

alarm 

remove  status 
remove  alarm 
display  status 
display  alarm 
display  new  alarm 
augment  new  alarm 
guidance 
canned  guidance 

status 

alarm 


zone  # 

date,  time 
zone  # ' s 
zone  status 
zone  status 
site  status 


zone  status 


yes/no 


zone#,  yes/no 

zone#,  yes/no 

zone# 

zone# 

zone# 

zone# 

message 

message 

message  # 
message  #,  zone# 
message  #,  message 
message  #,  zone#,  message 
message  #,  zone#,  message 
message  #,  zone#,  message 
message  #,  guidance  message 
message  (guidance)# 

message 

message 
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The  Message  Handler  and  the  DDU  Manager 

A major  function  of  the  Console  Process  is  to  maintain 
a data  base  of  current  DDU  messages,  and  manage  their 
presentation.  This  requires  a reasonable  amount  of  work  and 
has  resulted  in  this  function  being  split  into  a number  of 
modules.  The  Message  Handler  module  does  the  initial  pro- 
cessing of  a DDU  message  request,  by  updating  the  actual  DDU 
data  base  and  marking  the  resulting  status.  The  DDU  Manager 
module  acting  on  the  new  data  base  status  then  computes  the 
contents  of  a new  display  window  for  the  DDU,  and  the 
changes  required  to  the  current  display  window  to  produce 
the  new  display  window. 


The  DDU  Updater 

This  application  module  is  the  final  step  of  the  DDU 
function.  The  DDU  data  base  consists  of  two  separate,  but 
similar,  data  bases:  (1)  a Status  message  data  base,  and  (2) 
an  Alarm  message  data  base.  The  DDU  Updater  module  keeps 
track  of  which  data  base  is  currently  being  displayed.  If  a 
change  is  indicated  in  the  data  base  to  the  current  DDU 
display,  the  DDU  Updater  module  fills  the  DDU  buffer  with 
the  previously  computed  changes  required  to  produce  the  new 
display  window. 


The  Console  Monitor 

This  module  samples  the  console  switches  and  processes 
any  newly  activated  ones.  The  processing  starts  by  checking 
the  validity  of  the  activated  switch  against  the  current 
system  state.  If  it  is  not  valid,  then  some  combination  of 
an  audio  beep,  a printed  DDU  guidance  message,  and  an  audio 
guidance  message  will  provide  the  operator  error  feedback. 
If  the  activated  switch  is  valid  then  the  indicated  action 
is  initiated  by  updating  the  local  abreviated  status  infor- 
mation and  sending  the  appropriate  messages  to  the  Event 
Process . 


The  Light  Monitor 

Based  on  changes  in  the  local  status  and  data  base  this 
module  turns  on,  off,  or  flashes  the  lamps  in  the  console 
switches  and  indicators. 
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The  Scroller 


This  is  another  module  related  to  the  presentation  of 
the  DDU  message  data  base.  It  is  applicable  to  the  condi- 
tion of  too  many  messages  to  fit  onto  the  display  window  at 
one  time.  When  activated  this  module  will  compute  the  con- 
tents of  a new  display  window  that  is  the  current  display 
window  circularly  scrolled  up  by  a single,  but  entire,  mes- 
sage. Only  entire  messages  are  displayed,  never  any  partial 
messages.  When  successfully  activated  this  module  indicates 
to  the  scheduler  that  the  DDU  Update  module  should  be  the 
next  application  module  to  be  polled. 


The  Debugger 

This  module  was  used  during  debugging  and  is  intended 
for  normal  preventative  maintenance  and  trouble  shooting. 
It  interacts  with  a separate  terminal,  that  may  be  built  in 
or  a portable  one  that  can  be  plugged  in  when  required.  It 
allows  maintenance  personnel  to  interactively  peruse  the  lo- 
cal data  base  and  status  information,  monitor  the  contents 
of  messages  exchanged  with  the  Event  Process,  as  well  as  run 
predefined  diagnostics  while  the  system  continues  to  work. 


The  Event  Process 


The  Event  Process  maintains  a detailed  data  base  for 
all  zones  within  the  site.  This  data  base  contains  informa- 
tion on  the  state  of  each  zone  ( i . e . ,Secure , Alarmed,  Ac- 
cessed, etc.),  the  state  of  each  sensor  and  FEDS,  as  well  as 
a reference  to  all  currently  active  DDU  messages  residing 
within  the  DDU  message  data  base  maintained  by  the  Console 
Process . 

For  this  simulation  model  the  Event  Process  was  imple- 
mented within  an  interrupt  driven  operating  system  environ- 
ment, rather  than  a stand  alone  polling  environment  as  was 
the  Console  Process.  Under  this  type  of  environment,  when  a 
process  issues  a read  device  request,  the  process  is  usually 
blocked  until  the  read  request  is  completed.  When  the  dev- 
ice is  a terminal  or  a communication  link  to  another  pro- 
cess, the  duration  of  this  blocking  can  be  very  long, 
depending  on  whether  the  other  end  has  something  to  write. 
The  Event  Process  must  wait  for  asyncronous  input  from  the 
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Console  Process,  the  Director  Process,  and  from  a local  de- 
bugging terminal.  Therefore,  the  existing  blocked  I/O  of 
the  operating  system  was  not  acceptable.  A modification  was 
made  to  the  applicable  device  drivers  which  provided  a pro- 
gramable  user  option  to  invoke  non-blocked  device  reading. 
Under  this  option,  a read  request  would  complete  immediately 
with  an  indication  whether  or  not  there  was  something  to  be 
read.  This  modification  provided  the  Event  Process  the  ca- 
pability to  poll  each  of  these  devices  and  to  determine  when 
there  was  something  to  process. 

A block  diagram  of  the  software  organization  for  the 
Event  Process  is  shown  in  figure  19,  where  each  box 
represents  a module.  The  Controller  polls  the  communication 
channel  to  the  Console  Process,  the  Director  Process,  and  to 
the  Debugging  terminal.  When  a message  is  received,  the 
Control  module  passes  it  to  the  appropriate  handler  module 
for  processing. 
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Figure  17.  Organizational  block  diagram  of  Event  Process 
software.  Each  rectangle  represents  a module. 
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Console  Handler 


The  Console  Handler  module  processes  messages  from  the 
Console  Process,  These  messages  fall  into  two  general  ca- 
tegories (1)  request  for  specific  information  from  the  Event 
Process  data  base  and  (2)  notification  of  a legal  console 
action. 

The  first  category  of  Console  Process  messages,  request 
information,  is  relatively  straight  forward.  This  category 
includes  messages  such  as  "request  list  of  valid  zones", 
"request  abreviated  status  of  zone  15",  etc.  The  requested 
information,  located  within  the  Event  Process'  data  base,  is 
extracted  and  sent  to  the  Console  Process. 

The  second  category  of  Console  Process  messages,  action 
notification,  is  the  more  complicated  category  (e.g.,  fire 
FEDS  at  zone  4).  This  requires  the  Event  Process  to  check 
the  validity  of  the  action  for  the  current  system  state.  If 
it  is  not  valid,  then  either  a reject  message  or  a specific 
message  is  returned  to  the  Console  Process.  A reject  mes- 
sage is  a short  message,  that  causes  the  Console  Process  to 
update  its  local  abreviated  status  information  and  inform 
the  Operator  that  the  requested  action  failed.  Alternative- 
ly a specific  message  requires  the  Event  Process  to  assemble 
both  a completely  formatted  DDU  and  audio  guidance  message 
that  will  provide  the  Operator  with  specific  rejection  de- 
tails. These  messages  are  sent  to  the  Console  Process  which 
maintains  and  presents  them. 

If  the  action  is  valid  then  the  indicated  action  is  in- 
itiated by  first  updating  the  data  base.  Depending  on  the 
type  of  action  requested,  the  Event  Process  may  be  able  to 
affect  or  provide  the  desired  result  by  itself.  If  not  it 
must  then  send  an  appropriate  messages  to  the  Director  Pro- 
cess and  then,  while  noting  that  this  action  is  pending, 
wait  for  the  response.  When  the  results  of  the  action  are 
known,  either  success  or  failure,  the  Event  process  updates 
its  date  base  and  sends  a result  message  and  specific  mes- 
sages to  the  Console  Process.  A result  message  is  a short 
message,  which  causes  the  Console  Process  to  update  its  lo- 
cal abreviated  status  information.  Specific  messages,  as 
noted  above,  provide  the  Operator  details  on  the  results  of 
the  requested  action. 

It  should  be  noted  that  "determining  system  state", 
"updating  the  data  base",  and  "assembling  formatted  mes- 
sages" are  complex  operations  that  involve  significant  work- 
load. While  the  Event  process  is  servicing  these  various 
requests,  other  actions  and  requests  may  be  processed  in 
parallel  by  both  the  Console  and  the  Director  Process. 
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TABLE  6 


List  of  Messages  from  Director  Process  to  Event  Process 


Message  format: 


size  in 

command 

command 

bytes 

type 

number 

1 byte 

1 byte 

1 byte 

parameters 
^~by  tes 


COMMAND  TYPE  COMMAND  NUMBER  PARAMETERS 


device  0 - FEDS  at  zone# 
change 


zone# 

# of  FEDS 
good/failed  list 


1 - sensors  at  zone# 

2 - HQ  link 

3 - communication  change 


zone# 

# of  SENSORS 
good/failed  list 

good/failed 

zone#  (1  byte) 
good/failed/degraded 
direction  if  degraded 


4  - reload  FEDS 


zone  # 


test  0 

request  1 
2 

access  0 
results 


- FEDS 

- sensors 

- HQ  link 

- access 


zone# 

successful/failed 


1 - master  access  zone# 

successful/failed 


attack 


0 - alarm  sensor 


1 - quiet  sensor 


zone# 

# of  sensors 
list  of  sensors 

zone# 

# of  sensors 
list  of  sensors 
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TABLE  7 

List  of  Messages  from  Event  Process  to  Director  Process 
Message  format: 


size  in 

command 

command 

bytes 

type 

number 

parameters 

1 byte 

1 byte  1 byte 

n bytes 

COMMAND  TYPE 

COMMAND  NUMBER 

PARAMETERS 

send 

0 - FEDS  State 

zone# 

information 

state 

saf e/arm/f ire 

guard 

0 - LOGIN 

identity 

action 

1 - LOGOUT 

identity 

help 

called 

0 - BAF 

- 

1 - ARF 

access  request 

0 - ACCESS 

zone# 

1 - MASTER  ACCESS 

zone# 

Figure  21.  List  of 

messages  from  Event 

Process  to  Director 

Process , 


Director  Handler 

The  Director  Handler  module  processes  messages  from  the 
Director  Process,  figure  20,  These  messages  fall  into  three 
general  categories  (1)  devices  failure,  (2)  result  of  pend- 
ing action,  and  (3)  sensor  alarm. 
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The  first  category  of  Director  Process  messages,  device 
failure,  is  concerned  with  providing  the  current  operability 
status  of  the  various  devices  throughtout  the  entire  site 
(e.g.,  motion  sensor  failed  at  zone  17).  This  status  can  be 
operational,  partially  operational,  and  failed.  The  Event 
Process  updates  its  data  base  with  this  information,  and 
sends  both  a result  message  and  specific  messages  to  the 
Console  Process. 

The  second  category  of  Director  Process  messages,  ac- 
tion result,  provides  the  result  of  a previously  requested 
action  that  takes  place  somewhere  on  the  site  ( e.g.,  access 
successful  at  zone  10).  The  Event  Process  updates  its  data 
base,  clears  the  pending  status,  and  sends  both  a result 
message  and  specific  messages  to  the  Console  Process. 

The  third  category  of  Director  Process  messages,  sensor 
alarm,  is  a spontaneous  action  that  indicates  a sensor  has 
changed  state,  from  quiesent  to  active  or  active  to 
quiesent.  An  activated  sensor  indicates  that  a disturbance 
has  been  detected.  This  may  have  been  caused  by  an  in- 
truder, or  by  failure  of  the  sensor.  When  a sensor  is  ac- 
tivated the  Event  Process  first  tests  if  that  sensor  is 
operational.  If  the  sensor  is  known  to  already  be  in 
failure  mode,  the  activation  is  disregarded.  The  Event  Pro- 
cess updates  its  data  base  indicating  the  sensor  and  zone 
affected,  as  well  as  adding  the  zone  onto  the  Alarm  queue. 
Also  the  Console  Process  is  sent  a result  message  causing  it 
to  update  its  local  abreviated  status  and  specific  messages 
are  sent  to  inform  and  evoke  a response  from  the  Operator. 


Debugger 

The  Debugger  module  was  used  during  debugging  and  is 
intended  for  normal  preventative  maintenance  and  trouble 
shooting,  similar  to  that  for  the  Console  Process.  It  in- 
teracts with  a separate  terminal,  that  may  be  built  in  or  a 
portable  one  that  can  be  plugged  in  when  required.  It  al- 
lows maintenance  personnel  to  interactively  peruse  the  data 
base,  status  information,  and  the  contents  of  messages  ex- 
changed with  both  the  Console  Process  and  the  Director  Pro- 
cess, as  well  as  run  predefined  diagnostics,  while  the  sys- 
tem continues  to  function. 
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The  Director  Process 


The  Director  Process  is  the  driver  for  the  Event  and 
Console  Processes.  It  was  designed  to  accept  commands  from 
a human  operator  via  a terminal,  translate  those  commands 
into  one  of  the  messages  in  figure  20,  and  send  that  message 
to  the  Event  Process.  The  messages  represent  the  results  of 
actions  that  may  occur  at  the  various  zones  throughout  the 
site.  Since  the  Event  and  Console  Process  require  only  the 
resultant  action,  there  was  no  need  to  simulate  the  complex 
computations  required  to  determine  that  the  actions  actually 
occured . 

The  Director  Process  was  not  designed  to  keep  track  of 
the  system  state  or  to  automatically  execute  preprogrammed 
senarios.  Although  these  features  are  not  difficult  to  add 
and  they  would  be  useful  in  a training  environment,  they 
were  not  deemed  of  high  enough  priority  for  our  simulation 
model.  The  only  data  base  maintained  consisted  of  the 
current  list  of  active  zones  and  the  current  list  of  zones 
requesting  access.  Although  other  information  regarding 
changes  in  the  system  status  were  sent  to  the  Director  Pro- 
cess, they  were  displayed  to  the  Operator  and  not  retained. 
The  Director  Process  also  required  the  non-blocking  read  op- 
tion so  that  it  could  constantly  poll  the  terminal  for  com- 
mands from  the  operator,  and  the  communication  link  for  in- 
formation on  changes  in  system  status  from  the  Event  Pro- 
cess . 


EXPERIMENTS  USING  THE  SYSTEM 


A series  of  experiments  using  the  GCS  mock-up  were  con- 
ducted. The  first  of  these  involved  validating  the  system 
performance  to  insure  that  its  behavior  was  in  accordance 
with  specifications  in  all  respects.  Next,  certain  training 
materials  were  prepared  describing  the  CSSMRS  and  the  GCS. 
These  were  intended  to  support  a tutorial  presentation. 
Scenarios  were  written  that  could  be  used  to  provide  hands- 
on  experience  in  a simulated  physical  security  environment. 
These  materials  were  employed  in  experiments  in  which  co- 
workers who  did  not  have  a background  or  experience  in  phy- 
sical security  were  trained  to  use  the  system.  Finally,  a 
group  of  military  personnel  were  trained  to  operate  the  GCS. 
Observations  of  these  experiments  provided  insight  as  to  the 
ease  or  difficulty  of  learning  the  CSSMRS  concepts  and 
learning  to  use  the  GCS.  These  observations,  together  with 
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student's  comments,  also  provided  the  basis  for  a number  of 
minor  changes  in  the  physical  arrangement  of  the  console. 


! Validation  of  System  Performance 

j Key  aspects  of  the  performance  of  the  GCS  in  a simulat- 

I ed  CSSMRS  environment  were  described  by  a "partial"  state 

ij  diagram  that  was  amplified  by  a descriptive  event/result 

sheet  that  was  prepared  for  each  of  the  active  console  con- 
trols. This  process  was  repeated  for  each  of  the  system 
I states.  The  format  of  the  event/result  sheets  was  standard- 

I ized.  On  each  sheet  an  event  is  postulated  and  the  results 

I are  described.  In  most  instances,  the  postulated  event  is 

I the  actuation  of  one  of  the  console  controls.  The  descrip- 

j tion  of  the  results  includes  changes, to  status  as  well  as 

changes  to  any  of  the  displays,  messages,  audible  or  visual 
I signals,  or  other  operator  cues.  This  is  further  expanded 

! by  comments  where  appropriate. 

More  than  150  of  these  event/result  sheets  were 
prepared  using  a computer  based  word  processing  system. 
This,  together  with  the  standardized  format,  greatly  facili- 
tated making  necessary  revisions  or  up-dates.  These  sheets 
I served  as  the  guiding  basis  for  the  simulation  software  that 

was  developed  for  the  mock-up.  While  they  do  not  cover 
every  conceivable  event  that  could  occur  in  any  possible 
system  state,  they  are  sufficiently  broad  in  scope  that  the 
outcome  of  any  event  that  is  not  described  can  be  inferred 
with  a high  order  of  confidence. 

Validation  of  the  system  performance  was  accomplished 
by  going  through  each  of  these  event/result  sheets  and  test- 
ing to  verify  that  performance  was  in  compliance.  This  pro- 
cess revealed  a number  of  software  "bugs".  In  most  in- 
stances they  were  readily  corrected.  In  a few  cases  it  was 
determined  that  it  would  be  better  to  change  the  require- 
ments on  the  sheets.  Only  a few  instances  were  disclosed 
j where  the  event/result  sheets  did  not  provide  complete  cov- 

! erage  of  the  circumstances.  Additional  sheets  were  prepared 

I to  cover  those  situations. 

The  testing  and  validation  process  provided  an  initial 
indication  that  the  console  layout  was  generally  good,  it 
appeared  to  be  easy  to  use,  and  was  effective  in  conveying 
information  to  the  Operator. 
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Preparation  of  Training  Materials 

Two  types  of  materials  were  prepared  for  use  in  train- 
ing personnel  to  be  Operators  of  the  GCS. 

The  first  was  an  outline  of  a brief,  tutorial  instruc- 
tion course  that  covered  CSSMRS  concepts  that  are  essential 
in  order  to  operate  the  GCS.  These  include  such  things  as 
the  subdivision  of  the  site  into  zones;  the  association  of 
certain  console  controls  with  a zone  that  has  been  selected; 
communication  with  a zone;  access  to  a zone;  alarm  ack- 
nowledgement and  the  automatic  selection  of  closed  circuit 
television  for  assessment;  and  the  use  of  FEDS  and  the  ARF 
and  BAF  response  forces.  The  course  also  includes  a 
description  of  the  operation  of  the  GCS  itself.  There  are 
frequent  hands-on  exercises  and  demonstrations.  The  course 
material  can  be  thoroughly  covered  in  about  four  hours  of 
time,  with  additional  time  required  for  the  hands-on  experi- 
ence if  there  is  more  than  a single  person  in  the  class. 
The  course  outline  is  shown  in  Appendix  I. 

Additional  training  materials  were  prepared  in  the  form 
of  scenarios.  These  are  conducted  using  an  instructor  who 
plays  the  role  of  various  on-site  support  personnel  such  as 
mobile  patrols  or  maintenance  personnel.  A second  "direc- 
tor" plays  the  role  of  adversary  by  invoking  alarms  or  other 
events  from  a nearby  computer  terminal.  The  trainee  plays 
the  part  of  GCS  Operator  and  responds  to  the  alarms  or  other 
events  in  what  the  trainee  believes  to  be  an  appropriate 
manner.  The  instructor  and  the  director  have  copies  of  the 
scenarios  to  guide  their  actions,  but  the  student  does  not. 
The  students  actions  are  guided  solely  by  the  various  con- 
sole displays  and  signals. 

When  an  alarm  occurs,  CCTV  from  the  alarming  zone  is 
automatically  selected  and  displayed  on  one  or  both  of  the 
previously  dark  console  monitors.  In  order  to  provide  some 
basis  for  reasonable  operator  responses  to  simulated  alarms, 
it  is  necessary  to  simulate  video  data  from  the  alarming 
zone.  This  was  done  by  placing  still,  black  and  white  pho- 
tographs of  perimeter  fencing  in  the  fields  of  view  of  each 
of  three  television  cameras  that  were  located  near  the 
director,  figure  18. 

The  director  could  set  appropriate  pictures  in  place  before 
the  camera (s),  and  then  type  into  his  terminal  the  command 
that  would  cause  an  alarm  to  be  reported  and  simultaneously 
cause  the  picture (s)  to  be  displayed  on  the  console  monitor. 
A variety  of  pictures  were  available.  Some  of  these  showed 
adversary  attacks  on  the  perimeter  fence.  Others  showed  an 
intruder,  which  in  one  instance  was  a deer.  In  others, 
there  was  no  visible  evidence  of  what  might  have  caused  the 
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Figure  18.  Arrangement  of  CCTV  cameras  and  still  pictures. 

alarm  condition.  One  group  of  these  photographs  was  espe- 
cially made  for  the  scenarios  using  a camera  and  lens  combi- 
nation that  would  exactly  duplicate  the  fields  of  view  of 
the  two  cameras  that  were  specified  for  use  on  a 100  meter 
perimeter  segment  in  [1] . These  confirmed  that  the  resolu- 
tion was  adequate  to  recognize  a man-sized  intruder  anywhere 
along  the  full  length  of  the  segment. 

In  addition  to  the  three  fixed  CCTV  cameras,  there  was 
a fourth  camera  mounted  in  the  simulation  room  that  was 
equipped  with  controls  on  pan,  tilt,  zoom,  focus  and  iris 
that  could  be  remotely  manipulated  from  the  console  when  the 
zone  with  which  it  was  associated  had  been  selected.  This 
was  used  in  conjunction  with  a group  of  small  targets  that 
had  been  scattered  about  the  room  to  give  the  students  an 
opportunity  to  develop  their  skills  in  camera  manipulation. 
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The  scenarios  covered  a considerable  range  in  complexi- 
ty. They  ranged  from  simple  exercises  intended  to  develop 
speed  and  confidence  in  finding  and  operating  the  various 
controls  to  more  complex  and  stressful  exercises  simulating 
a multi-person  attack  on  the  storage  site.  They  include  ex- 
amples of  virtually  all  of  the  actions  that  an  operator 
would  be  required  to  participate  in,  such  as  key  issuance, 
access,  maintenance  actions,  and  testing  activities  as  well 
as  alarm  acknowledgement,  patrol  dispatching  and  FEDS  actua- 
tion. An  example  of  one  of  the  more  complex  scenarios  ap- 
pears in  Appendix  I. 


Tests  of  Training  Materials 

Initial  tests  of  the  training  materials  were  conducted 
in  two  separate  sessions  using  two  co-workers  who  were  not 
familiar  with  the  project  or  with  physical  security  pro- 
cedures. In  each  instance,  less  than  one  day  was  devoted  to 
the  training  effort.  The  time  was  approximately  evenly  di- 
vided between  the  course  material  and  the  scenarios. 


Test  by  an  Electronics  Technician 

The  first  person  to  test  the  training  materials  was  a 
male  electronic  technician  who  had  not  previously  partici- 
pated in  the  construction  of  the  console  or  had  any  intimate 
connection  with  the  project.  He  was  presented  with  the  tu- 
torial course  material  for  approximately  an  hour,  and  then 
was  initiated  to  the  scenarios.  He  quickly  learned  to  use 
the  GCS,  but  some  of  his  scenario  response  actions  were 
sub-optimal  and  it  was  apparant  that  the  time  devoted  to 
covering  the  tutorial  material  should  be  lengthened.  This 
trainee's  handling  of  the  console  controls  was  generally 
good,  but  on  a couple  of  occasions  he  made  errors  in  the 
zone  selection  process.  This  served  as  an  alert  to  a possi- 
ble repetition  of  these  errors  on  the  part  of  future 
trainees . 


Test  by  a Secretary 

The  second  trainee  was  a female  secretary  that  was  re- 
ported by  her  supervisor  to  be  a satisfactory,  average  per- 
former in  her  regular  job.  In  this  instance,  presentation 
of  the  tutorial  portion  of  the  course  material  was  extended 
to  about  two  hours  before  work  was  started  on  any  of  the 
scenarios.  She  seemed  to  grasp  the  material  quite  quickly. 
She  had  no  problems  with  any  of  the  controls  and  all  of  her 
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response  actions  to  simulated  alarm  conditions  were  judged 
satisfactory.  The  only  problem  that  she  seemed  to  experi- 
ence was  that  of  simulating  radio  communications  with  the 
guard  patrols.  This  was  an  area  that  had  not  been  covered 
in  the  instructional  material,  and  since  she  had  had  no  pri- 
or experience  as  a communicator,  her  difficulty  here  was 
quite  understandable.  In  all  other  respects  her  performance 
as  an  operator  of  the  GCS  was  highly  commendable. 


Training  of  Military  Personnel 

During  the  first  week  of  October,  1982,  five  male  mil- 
itary personnel  were  trained  to  use  the  GCS.  One  of  these 
was  an  Air  Force  Master  Sargent  with  extensive  experience  in 
physical  security  equipment,  having  served  as  chief  instruc- 
tor for  the  Small  Portable  Control  and  Display  System 
(SPCDS)  of  the  Base  and  Installation  Security  System  (BISS). 
The  other  four  were  Army  Military  Police  from  Ft.  Meade  with 
no  significant  experience  with  security  systems  or  special 
weapons  storage  sites. 

Most  of  the  first  day  was  spent  going  over  the  tutorial 
portion  of  the  course  material.  This  was  interspersed  with 
frequent  hands-on  sessions  where  the  students  operated  the 
controls  and  began  to  get  the  feel  of  the  system.  None  of 
them  seemed  to  have  any  difficulty  understanding  the  system 
concepts  and  learning  the  meanings  of  the  various  signals 
and  displays. 

When  the  tutorial  portion  of  the  course  material  had 
been  covered,  all  of  the  students  but  one  were  isolated  from 
the  simulation  laboratory.  The  one  student  remaining  in 
that  laboratory  then  operated  the  GCS  while  the  scenarios 
were  played  out.  Then  another  student  was  brought  in  to 
participate  in  running  the  scenarios.  The  reason  for  the 
isolation  of  the  others  was  to  keep  them  all  at  the  same 
level  of  training  on  their  initial  exposure  to  the 
scenarios.  Once  they  had  completed  the  scenarios  they  were 
permitted  to  remain  in  the  simulation  laboratory  to  watch 
the  next  student's  actions.  All  of  them  performed  quite 
well,  and  very  few  mistakes  were  made.  Those  few  generally 
involved  zone  selection,  but  the  trainees  themselves  did  not 
seem  to  notice  this,  Occasionaly  a student  would  make  a 
response  that,  while  not  exactly  in  accordance  with  the 
response  anticipated  in  the  scenarios,  was  still  acceptable. 
In  these  cases  the  instructor  and  director  were  nearly  al- 
ways able  to  make  impromptu  moves  that  would  lead  the  simu- 
lated action  back  to  the  prepared  script. 
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When  all  of  the  trainees  had  completed  all  of  the 
prepared  scenarios,  they  were  given  brief  instructions  in 
the  operation  of  the  computer  terminal  used  by  the  director 
to  simulate  adversary  actions.  They  very  quickly  mastered 
this,  and  then  preceded  to  generate  and  act  out  impromptu 
scenarios,  with  each  student  taking  turns  at  playing  the 
different  roles  of  director,  instructor,  and  operator.  They 
became  quite  proficient  at  this,  and  generated  a number  of 
very  realistic  event  sequences.  They  became  adept  at  keep- 
ing track  of  the  locations  of  the  simulated  patrols  that 
they  dispatched  to  assess  alarm  conditions  or  conduct 
maintenance  activities.  They  conducted  impressive  demons- 
trations for  several  visitors  to  the  simulation  laboratory, 
and  seemed  to  be  thoroughly  comfortable  and  at  home  with  the 
system. 

At  the  conclusion  of  the  training  sessions,  they  were 
each  given  a questionaire  to  complete.  This  was  intended  to 
draw  out  their  comments  about  what  they  found  to  be  good  or 
bad  about  the  arrangement  of  the  console  and  its  controls 
and  displays.  A copy  of  the  questionaire  and  their  combined 
responses  and  comments  appears  in  Appendix  II. 


SUMMARY  AND  CONCLUSIONS 


Observations  of  the  performance  of  the  seven  individu- 
als that  have  been  trained  to  operate  the  GCS  provides  con- 
vincing evidence  that  most  of  the  original  design  objectives 
have  been  met.  The  trainees  invariably  found  that  the  GCS 
was  easy  to  learn  and  easy  to  use.  They  did  not  find  it  in- 
timidating or  overpowering  and  seemed  to  feel  quite  comfort- 
able with  it  after  a relatively  short  period  of  time.  The 
displays,  cues  and  guidance  messages  were  judged  adequate  in 
terms  cf  size,  resolution  and  information  content,  but 
further  improvements  can  be  made  by  relocating  certain 
displays  and  controls,  and  by  adding  another  group  of 
displays.  The  queueing  of  multiple  alarms,  and  the  operator 
controlled  display  of  detailed  information  about  only  one 
alarm  at  a time  provided  obvious  relief  from  information 
overload.  This  was  in  marked  contrast  to  the  more  congested 
display  of  status  information  that  appears  in  chronological 
sequence  on  the  DDU  when  the  zone  that  has  been  selected  is 
secure . 
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Console  Design  Changes 


Based  on  a review  and  analysis  of  both  our  observations 
and  the  comments  of  the  trainees,  a number  of  changes  to  the 
design  of  the  GCS  console  are  being  reflected  in  the  specif- 
ications for  a prototype  CSSMRS.  These  are  discussed  in  de- 
tail in  the  following  sections. 


10-Digit  Keypad 

On  the  mock-up,  a 10-digit  keypad  is  located  on  the 
right  hand  side  of  the  console  table.  This  is  used  to  enter 
digital  information  into  the  system.  The  digital  informa- 
tion is  either  a 10-digit  operator  identification  number  or 
a one-to-three-digit  zone  number.  The  number  that  is  en- 
tered on  the  keypad  appears  on  a 10-digit  liquid  crystal 
display  directly  above  the  keypad.  When  a zone  number,  con- 
sisting of  only  one-to-three-digits , is  entered,  nothing 
else  happens  until  the  SELECT  ZONE  control  is  operated.  At 
that  time,  the  number  that  has  been  entered  in  the  10-digit 
display  is  transferred  to  the  3-digit  ZONE  SELECTED 
displays,  and  the  10-digit  display  is  cleared.  Console  con- 
trols and  CCTV  (if  available)  are  attached  to  the  zone  that 
has  been  selected. 

On  certain  occasions,  student  GCS  operators  were  ob- 
served to  be  watching  the  ZONE  SELECTED  display  rather  than 
the  10-digit  display  as  they  made  entries  on  the  keypad. 
There  was  hesitancy  and  a brief  period  of  confusion  before 
they  realized  what  the  problem  was.  Additionaly,  observa- 
tions of  hand  movements  indicates  that  a faster,  more  posi- 
tive zone  selection  would  occur  if  the  10-digit  keypad  is 
relocated  to  a position  directly  below  that  presently  occu- 
pied by  the  ZONE  SELECTED  display  on  the  console  table.  The 
SELECT  ZONE  control  will  be  moved  from  its  present  location 
and  will  appear  as  a pair  of  keys,  one  located  on  either 
side  of  the  keypad. This  will  permit  zone  selection  to  be 
made  by  operation  of  either  key,  using  either  the  thumb  or 
little  finger.  The  entire  process  can  be  completed  without 
the  arm  movement  that  is  presently  required  on  the  mock-up. 

The  relocated  keypad  will  be  used  only  for  entering 
zone  identity  and  not  for  entering  operator  identity.  The 
keypad  will  require  much  better  tactile  characteristics  than 
the  keypad  used  on  the  mock-up.  The  feel  should  be  similar 
to  that  of  the  keys  on  the  typical  computer  terminal  or 
electric  typewriter.  In  addition,  the  keys  should  be  color 
coded  with  the  electronic  industry  code  as  well  being  la- 
beled with  the  digit  value.  This  will  permit  the  zones  in 
small  sites  to  be  identified  by  "color"  rather  than  "number" 
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if  desired.  A software  switch  should  be  provided  so  that 
zones  zero  through  nine  can  be  optionally  identified  by  a 
color  instead  of  a number.  The  equivalence  of  number, 
color,  and  a three  character  abbreviation  of  that  color  are 
shown  in  Table  8 below. 


TABLE  8 

Color  Code  For  Zones  0-9 


Zone 

Color 

Abbreviation 

0 

Black 

BLK 

1 

Brown 

BRN 

2 

Red 

RED 

3 

Orange 

ORN 

4 

Yellow 

YEL 

5 

Green 

GRN 

6 

Blue 

BLU 

7 

Violet 

VIO 

8 

Gray 

GRA 

9 

White 

WHI 

digit 

ZONE  SELECTED  display  will  be 

replaced 

with  a three-character  display  labeled  ENTRY.  Keypad  en- 
tries will  appear  here  until  the  SELECT  ZONE  (or  CLEAR)  key 
is  depressed,  and  then  this  display  will  go  blank  again. 
When  the  software  switch  is  set  to  COLOR,  the  display  will 
show  the  three  character  abbreviation  of  the  color  of  the 
key  that  is  operated.  When  the  switch  is  set  to  NUMBER  the 
display  will  show  the  numerical  value  of  the  keys  (up  to 
three  digits)  that  are  actuated.  When  the  SELECT  ZONE  key 
is  actuated,  the  information  shown  in  the  display  is 
transferred  to  the  other  ZONE  SELECTED  displays. 


Selected  Zone  Status  Display 

The  six  colored  lamps  at  the  top  of  the  console  panel 
provide  a "quick  look"  indication  of  overall  site  status 
that  is  more  useful  to  a supervisor  than  to  the  Operator. 
As  long  as  the  Operator  has  selected  a zone  that  is  in  an 
alarmed  state  his  display  provides  him  with  complete  and  un- 
cluttered information  about  that  zone.  However,  when  the 
Operator  selects  a zone  that  is  not  in  the  alarmed  state, 
the  display  shows  status  information  that  may  involve  a 
number  of  zones.  The  Operator  must  read  through  this  to 
learn  the  status,  such  as  ACCESS,  REPAIRS  REQUIRED,  or  other 
conditions  affecting  a particular  zone. 
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Two  changes  will  improve  this  situation.  The  informa- 
tion on  the  status  display  can  be  better  organized  (this 
will  be  described  in  a following  section),  and  a zone  status 
display  can  be  added.  The  added  zone  status  display  will 
contain  a three-character  LCD  display  and  six  colored  lamps 
which  replicate  all  of  the  functions  of  the  site  status  sum- 
mary group.  This  zone  status  display  will  be  mounted  on  a 
panel  located  directly  behind  the  MPS  and  beneath  the  DDU. 
When  an  operator  selects  a zone,  either  by  use  of  the  keypad 
or  by  operation  of  the  MPS  to  select  an  alarmed  zone,  the 
identity  of  the  selected  zone  will  appear  in  the  three- 
character  display.  Zone  identity  may  be  either  a number  or 
color  depending  on  the  setting  of  the  software  switch.  The 
status  of  this  zone  will  be  indicated  by  illuminating  one  or 
more  of  the  six  associated  status  lamps. 


Organization  of  Status  Display  on  DDU 

In  the  mock-up,  status  information  is  displayed  on  the 
DDU  whenever  the  selected  zone  is  in  a non-alarmed  state. 
The  information  is  ordered  chronologically  rather  than  being 
grouped  by  class  or  condition.  Thus,  if  the  white,  REPAIRS 
REQUIRED,  summary  status  lamp  is  lit,  it  may  be  necessary  to 
scan  the  full  list  of  status  messages  in  order  to  ascertain 
which  zone(s)  require  maintenance.  This  will  be  changed, 
and  the  entries  will  be  grouped  by  class,  and  listed  chrono- 
logically within  each  class.  Alternate  classes  will  be  in 
reverse  video  to  define  the  class  without  loss  of  screen 
area  that  would  be  required  to  provide  separation  by  insert- 
ing a blank  line  between  groups,  however,  if  any  class  is 
empty,  a blank  line  will  be  inserted  in  its  place. 

The  top  line  of  the  status  display  will  be  used  for  re- 
porting the  number  of  outstanding  uncleared  alarms.  This 
report  will  be  in  double  width  letters,  and  will  blink  con- 
tinuously so  long  as  there  are  any  outstanding  alarms. 
Video  will  not  be  reversed. 

The  first  group  will  be  reverse  video  and  display  any 
zones  in  Access. 

The  second  group  will  be  normal  video.  It  will  display 
any  time  dependent  actions  such  as  KEY  SENT.  The  remaining 
time  on  any  items  in  this  group  will  be  continuously  decre- 
mented at  intervals  of  not  less  than  one  minute,  and  the  en- 
try will  be  removed  when  the  time  limit  has  expired. 
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The  third  group  will  be  reverse  video.  The  entries 
will  be  updated  with  each  automatic  cycle  of  sensor  and  FEDS 
tests  conducted  by  the  central  processor  unit  and  any 
failures  are  listed.  The  entries  will  also  list  all  other 
maintenance  actions  that  are  outstanding. 


The  fourth  group  will  list  the  names,  but  not  identity 
numbers,  of  operators  logged  in  and  on  duty,  in  normal 
video. 

A variable  size  window  at  the  bottom  of  the  screen  will 
be  used  to  display  operator  guidance  messages  as  on  the 
mock-up.  It  and  the  top  line,  displaying  uncleared  alarms, 
will  not  be  affected  by  the  scroll  control,  while  the  other 
four  groups  of  status  messages  will  be  scrollable. 


Login/Logout 

The  provisions  for  operators  to  login  and  logout  of  the 
system  will  be  revised  to  protect  the  identification  number 
of  operators  from  being  disclosed  to  possible  unauthorized 
or  unqualified  personnel.  This  will  be  accomplished  by  re- 
moving the  present  10-digit  keypad,  10-digit  display  and  the 
LOGIN  and  LOGOUT  controls  from  the  console  table  and  locat- 
ing them  in  a recessed,  covered  enclosure  which  may  be  at 
any  convenient  location  in,  or  adjacent  to  the  control  room 
containing  the  GCS.  Again,  the  keypad  will  have  greatly  im- 
proved tactile  characteristics  as  compared  with  the  one  used 
in  the  mock-up,  but  color  coding  is  not  required  here. 

When  a valid  login  occurs,  the  operators  name  but  not 
identity  number  will  be  displayed  on  the  status  display. 
The  voice  annunciation  will  be  truncated  to,  "Valid  (In- 
valid) Operator  Login  (Logout)”,  since  it  would  be  impracti- 
cal to  continuously  update  roster  names  for  the  voice  unit. 


CCTV  Facilities 

On  the  mock-up,  there  is  a three-digit  display  indicat- 
ing the  selected  zone  and  a cluster  of  lamps  indicating  TV 
facilites  at  that  zone  associated  with  each  of  the  monitor 
pairs.  They  are  located  to  the  left  of  the  left  hand  moni- 
tor pair  and  to  the  right  of  the  right  hand  monitor  pair. 
These  were  judged  to  be  too  far  toward  the  periphery  of  vi- 
sion, and  will  be  moved  to  a position  between  each  of  the 
monitor  pairs  and  as  close  to  the  DDU  as  feasible.  The 
three-digit  displays  will  be  changed  to  three  character 
displays  to  accomodate  zones  identified  by  colors,  and  an 
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up-arrow  and  down-arrow  will  be  added  to  each.  These  arrows 
will  be  selectively  illuminated  to  point  to  the  monitors 
that  should  be  active  for  the  selected  zone.  They  will  pro- 
vide cues  to  CCTV  malfunction,  since  if  both  arrows  are  il- 
luminated and  only  one  monitor  is  operating,  there  is  evi- 
dence of  a problem  with  the  dark  video  channel. 

Increased  visibility  of  the  CCTV  facilities  indicators 
will  be  provided  by  removing  the  smoke  colored  indicator 
covers  and  using  covers  with  greater  translucence  or  less 
attenuation.  The  intensity  of  the  lamps  in  all  of  the  indi- 
cators has  been  lowered  somewhat  by  operating  them  at  a re- 
duced voltage  (5.0  volts  rather  than  6.3  volts)  in  order  to 
provide  a projected  life  of  290,000  hours  (33  years).  This 
is  in  keeping  with  overall  CSSMRS  reliability  objectives. 


Pan/Tilt/Zoom  Control 

The  Pan/Tilt/Zoom  CCTV  control  will  be  moved  back  about 
10  cm.  (three  inches)  farther  from  the  edge  of  the  console 
table.  This  location  is  judged  to  be  more  appropriate  to 
the  expected  frequency  of  use  since  few  zones  are  expected 
to  be  equipped  with  cameras  that  are  controllable.  The  new 
location  will  improve  the  access  and  visibility  of  the  con- 
trols associated  with  the  electronic  key. 


Monitor  Pointing  Switch 

The  handle  on  the  MPS  will  be  shortened  by  about  three 
cm.,  and  the  throw  of  the  switch  will  be  increased  to  a full 
90  degrees,  side  to  side.  This  control  is  the  single,  most 
used  control  on  the  console,  and  it's  continued  operation  is 
vital  to  the  operation  of  the  system.  Further  reductions  in 
size  would  be  at  an  unacceptable  cost  of  reduced  mechanical 
strength  and  durability. 


Scroll  Control 

The  SCROLL  control  will  be  moved  to  a position  to  the 
right  of  the  MPS  and  symmetrically  located  with  the  SAFE 
FEDS  control. 
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Emergency  Controls 

The  CALL  BAF  and  the  CALL  BAF  & ARF  controls  will  be 
separated  from  each  other  and  placed  in  locations  that  are 
symmetrically  aligned  with  ARM  FEDS  and  SAFE  FEDS.  A 
locked,  key  operated  switch  labeled  FIRE  WADS  (Weapons  Ac- 
cess Denial  System)  will  be  located  in  line  with  these  two 
controls  and  aligned  with  FIRE  FEDS. 


Key  Port 

The  system  specifications  will  make  provision  for  a 
second  key  port  that  duplicates  the  functions  of  the  console 
key  port  but  is  remotely  located  from  the  console.  The  lo- 
cation of  this  duplicate  key  port  may  be  outside  of  the  con- 
trol room  so  that  it  is  possible  to  load  an  electronic  key 
without  having  to  gain  access  to  the  control  room. 


Electronic  Key 

The  final  design  of  the  electronic  key  will  incorporate 
an  LCD  display  that  shows  the  remaining  key  life.  This 
display  will  be  in  minutes  and  seconds,  and  will  be  updated 
each  second. 


Writing  Shelves 

A pair  of  pull-out  shelves  will  be  provided  on  the  con- 
sole, one  on  either  side  of  the  operator.  These  can  be  used 
as  surfaces  for  writing. 


Summary  of  Changes 

Figures  19  and  20  show  the  general  arrangement  of  the 
GCS  console  after  these  changes  have  been  reflected.  Figure 
19  shows  the  console  back  panel  and  figure  20  shows  the  con- 
sole table  top. 
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Figure  19.  Console  Back  Panel 
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Figure  20.  Console  Table  Top 


Conclusions 


The  mock-up  of  the  GCS  and  its  operation  in  a simulated 
physical  security  environment  has  provided  an  excellent  op- 
portunity to  evaluate  both  the  ergonomics  of  its  design  and 
the  potential  utility  of  such  a simulator  as  a training  dev- 
ice. 

Observations  of  the  actions  and  performance  of  trainees,  and 
careful  evaluation  of  their  comments  in  relations  to  these 
observations  has  suggested  a number  of  minor  changes  in  the 
arrangement  of  console  controls  and  indicators.  Their  in- 
clusion in  the  design  of  a future  prototype  model  of  the 
CSSMRS  will  make  small,  but  useful  improvements  in  the 
speed,  accuracy,  and  ease  of  GCS  operation.  It  is  believed 
that  none  of  these  changes  will  have  noticeable  effects  on 
the  process  of  learning  to  use  the  GCS,  as  it  is  felt  that 
the  principal  objectives  with  respect  to  this  process  were 
attained  with  the  original  mock-up  design.  None  of  the 
seven  students  that  were  trained  appeared  to  experience  any 
difficulty  in  learning  to  operate  the  GCS. 

As  a training  tool,  the  present  implementation  of  the  system 
has  several  significant,  but  potentially  correctable  defi- 
ciencies, These  involve  characteristics  of  the  programming 
that  was  prepared  for  the  director  processor  and  its  termi- 
nal, the  CCTV  video  presentation  to  the  Operator,  and  the 
fact  that  several  important  adjuncts  to  the  CSSMRS  GCS  were 
not  implemented  in  this  mock-up. 


Director  Software 

The  software  for  the  director  processor  was  not  ar- 
ranged to  support  several  capabilities  that  would  be  highly 
desireable  on  a training  simulator.  For  example,  there  was 
no  provision  by  which  multiple  alarms  could  be  simultaneous- 
ly introduced  at  several  zones,  or  by  which  alarms  at 
several  zones  could  be  quieted  simultaneously.  Alarms  at 
each  zone  had  to  be  introduced  and  quieted  individually  by 
keyboard  entries  at  the  director's  terminal.  The  delays  as- 
sociated with  this  process  would  prevent  a realistic  simula- 
tion of  certain  classes  of  events,  and  errors  in  keyboard 
entries  can  cause  unintended  results. 

For  training  purposes,  it  would  be  highly  desireable  to 
program  entire  scenarios  so  that  they  could  be  completely 
executed  by  the  director  processor  without  a requirement  for 
interaction  by  anyone  other  than  the  student  trainee  at  the 
GCS.  The  processor  could  even  be  programmed  to  score  the 
trainee's  performance.  This  would  reduce  the  manpower 
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required  to  conduct  a training  session. 


GCS  Video 

The  use  of  black  and  white,  still  photographs  as  a 
demonstration  of  the  resolving  power  that  results  from  the 
use  of  the  recommended  arrangement  of  perimeter  CCTV  cameras 
proved  to  be  quite  effective.  Those  same  photographs,  how- 
ever, are  not  very  realistic  alarm  assessment  imagery.  The 
lack  of  motion,  and  the  small  number  of  cameras  that  made  it 
necessary  to  reuse  a given  camera  on  more  than  one  zone,  all 
detracted  from  the  illusion  of  reality.  We  would  recommend 
that  a training  facility  be  equipped  with  from  eight  to 
twelve  video  tape  units.  There  should  be  one  for  each  zone 
of  the  simulated  facility  that  is  equipped  with  CCTV.  Their 
tapes  should  be  pre-recorded  with  scenes  and  actions  that 
are  appropriate  to  the  director  processor's  scenario,  and 
they  should  be  started  simultaneously  at  the  beginning  of 
the  scenario,  and  should  run  continuously  for  its  duration. 
This  could  provide  extremely  realistic  video.  For  example, 
if  a student  should  happen  to  be  attached  to  a zone  where 
the  scenario  had  scheduled  an  alarm  to  occur,  the  student 
might  actually  see  the  intruder  approach  the  perimeter  a 
second  or  so  before  the  alarm  was  triggered! 


Features  Not  Implemented 

We  recommend  that  a simulation  training  facility  should 
be  provided  with  several  of  the  GCS  adjunct  facilities  that 
were  not  implemented  on  this  mock-up.  These  include  a Geo- 
graphical Display  Unit  (GDU)  replicating  the  layout  of  the 
simulated  site  and  equipped  with  status  indicator  lamps  for 
each  zone.  This  is  particularly  important  as  the  console 
DDU  does  not  present  any  geographic  information  to  the 
operator;  it  was  intended  that  this  would  be  provided  by  the 
GDU.  It  is  needed  in  order  to  provide  the  operator  with  an 
overall  perspective  on  the  locations  of  possibly  related 
alarms . 

Another  facility  that  is  not  adequately  implemented  on 
the  mock-up  is  that  for  communications,  including  radio, 
telephone  and  intercomm.  In  fact,  until  these  have  been  im- 
plemented and  tested,  it  is  not  clear  whether  or  not  a sin- 
gle operator  can  handle  the  work  load,  or  whether  some  por- 
tions of  the  communications  functions  may  have  to  be  handled 
by  another  person. 
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The  logging  functions  should  also  be  implemented  in  a 
facility  intended  for  training  in  order  to  insure  that  stu- 
dents are  properly  instructed  in  the  procedures  for  record- 
ing the  dispositions  of  alarms.  This  administrative  func- 
tion was  not  addressed  at  all  in  the  exercises  involving  the 
mock-up. 

With  the  implemetation  of  thesei  additional  adjunct  fa- 
cilities and  capabilities,  we  believe  that  a highly  effec- 
tive training  facility  could  be  set  up  based  on  the  general 
software  approach  to  simulation  that  has  been  demonstrated 
in  this  project. 
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GLOSSARY  OF  ACRONYMS  AND  ABBREVIATIONS 


ACK 

Acknowledge 

ARE 

Augmentation  force.  This  force  may  be  located  at 
higher  headquarters. 

BAF 

Back-up  force.  This  force  is  located  on  or  near 
the  secure  site. 

CCT7 

Closed  circuit  television. 

CSSMRS 

Computerized  Site  Security  Monitor  and  Response 
System. 

FEDS 

Forced  Entry  Deterrent  Systems. 

GCS 

Guard  Control  Station. 

HQ 

Headquarters . 

MPS 

Monitor  Pointing  Switch. 
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APPENDIX  1 


Outline  of  GCS  Console  Instruction  Course 


1.  Background  of  CSSMRS 

A.  Experiment  to  see  if  modern  technology  can  be 
used  to  improve  the  physical  security  of 
Special  Weapons  storage  sites, 

B.  Use  the  computer  to  help  make  the  guard's  job 
easier.  Provide  guidance  toward  the  right  choice 
of  action. 

C.  Does  not  require  that  the  guard  know  anything  about 
computers  or  know  how  to  type.  The  system  uses 
functional  controls  with  guidance  by  means  of 
lights  and  voice  announcements  as  well  as  printed 
messages  on  the  screen. 

D.  A novice  cannot  do  anything  to  hurt  the  system. 

If  the  wrong  control  is  pushed,  it  will  tell  you, 
or  ask  you  to  Cancel  or  Confirm  that  order.  In 
other  words,  "Do  you  really  want  to  do  that?" 

E.  Our  objective  is  to  find  out  whether  or  not  it 
really  is  easy  to  learn  to  use,  and  if  it  is  not, 
find  out  what  to  change  before  a prototype  is  built. 

2.  CSSMRS  Concepts 

A,  The  site  is  divided  into  zones  - each  zone  is 

100  m.  perimeter  - one  football  field  long  - or 
one  magazine  or  bunker 

B.  Each  zone  has  the  following; 

Intrusion  sensors  which  might  include; 

Maid/Miles  Radac 

Motion  (ultrasonic,  RF  or  TV)  Spir 

E-Fild  Blid 

Vibration  (three  types)  Optical 

Magnetic  Switch  Infra-red 
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Tamper  Alarms 
Explain  each 


Duress 

Audio 


Closed  Circuit  Television  to  assess  alarms  - 
TV  may  include  controls  and  lights 

Forced  Entrance  Deterrence  Systems 
Gas 
Smoke 
Pyro 

Explain  each  - all  are  conceptual 

A Computer 

With  communications 
Two  way  - with  dual  loops 
That  takes  over  if  communications  fails 
and  won't  let  anybody  in! 

That  reports  alarms 
That  can  test  sensors 
That  can  test  FEDS 
That  helps  control  access 

C.  There  is  a Central  Station  with  computers 

It  acts  as  a link  between  the  zones  and  two  GCS 
It  talks  to  the  zone  computers 
It  runs  the  controls  and  displays  on  the  GCS 
It  talks  to  higher  headquarters 
It  calls  BAF  or  BAF  and  ARF  if  the  GCS 
operator  is  disabled 

D.  There  are  two  Guard  Control  Stations  in  a real  CSSMRS 

(only  one  has  been  implemented  in  this  model)  which 

Permit  interactions  between  the  guards  and  the 
system  by: 

Displays 

Hand  out  list 
Identify  each  on  GCS 

Signals  and  voice  announcements 

Controls 

System  - hand  out  list 

Identify  each  on  GCS 
Attachable  - hand  out  list 

Identify  each  on  GCS 

Demonstrate  simple  interactions  - provide 
hands-on  practice: 
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Log  in 
Logout 

Test  indicators 
Test  sonic 
Select  zone  2 

Observe  CCTV  controls  there 
Select  zone  4 

Observe  CCTV  controls  there 
Operate  controls 
Test  FEDS 
Test  Sensors 
Voice  repeat 
Scroll 

E.  Each  zone  has  security  status  that  depends  on 
prevailing  conditions 

Hand  out  list  of  status  displays 

SECURE 

Define 

Status  information  on  display 
Most  likely  controls  to  use  are  lighted 
CCTV  (if  any)  on  monitor  that  MPS  is 
pointing  toward 
Demonstrate  above 

ALARM  UNACKNOWLEDGED 
Define 

Voice  and  display  announcement 
Audible  alarm  sequence  begins 
Flashing  lights  in  controls 

Most  other  controls  disabled 
CCTV  from  new  alarm  on  the  dark  monitors 
MPS  not  pointing  to  these 
BAF  call  out  if  no  acknowledgement 
Demonstrate  above 

ALARM  ACKNOWLEDGED 
Define 

Display  shows  full  alarm  report 
Audible  alarm  sequence  is  stopped 
Status  light  is  on  steady 

Most  likely  candidate  controls  are  lighted 
Controls  associated  with  zone  MPS  pointing 
toward 

Demonstrate  above 


ACCESS 

Define 

Most  likely  candidate  controls  are  lighted 
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Status  information  on  display 
Demonstrate  above 

REPAIRS  REQUIRED 
Define 
Demonstrate 

COMMUNICATIONS  FAILURE 
Define 

No  controls  operable  at  this  zone 

Zone  autonomous 

Demonstrate 

CONTENTION 

Define 

Not  implemented  in  this  model 

3.  Instruction  in  the  use  of  Guard  Control  Station 

Review  use  of  keypad  and  significance  of  lights 

A.  When  an  alarm  occurs 

TV  from  the  alarming  zone  appears  on  the  previoulsy 
blank  screens 

Appears  immediately 

Provide  opportunity  to  catch  moving  targets 

Alarm  must  be  acknowledged  to  prove  to  the  system 
that  the  guard  is  not  disabled. 

30  seconds  - one  tone 
30  more  seconds  - another  tone 
10  more  seconds  - a buzzer 
Then  BAF  is  automatically  called 

How  would  you  like  to  face  your  buddies 
if  you  dragged  them  out  of  the  sack  for 
not  acknowledging  an  alarm  on  time? 

Two  ways  to  acknowledge  an  alarm 

MPS  - attaches  controls  to  alarmed  zone 
ACKNOWKEDGE  - does  not  attach  controls  to  zone 
Demonstrate  each  way 

After  acknowledgement,  must  find  out  what  caused 
alarm 

Examine  scene  in  CCTV 
Send  patrol  to  investigate 

If  intruder  is  observed,  there  are  options 
Send  patrol  to  apprehend 

Demonstrate  simulated  radio  call 
Actuate  FEDS 

Demonstrate 
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Arm  FEDS 
Fire  FEDS 
Confirm 

Call  BAF 

Demonstrate 

Confirm 

Call  BAF  and  ARF 

Demonstrate 

Note  one  time  functions 

If  more  than  one  alarm  occurs  they  are  added  to 
queue  by  acknowledgement. 

Step  through  queue  using  MPS 

Only  one  at  a time  appears  on 
display 

The  number  of  the  zone  you  are  looking  at 
is  always  displayed 

Practice  alarm  acknowledgement  for  each  trainee 


B.  Clearing  alarms 

Conditions  for  clearing: 

You  must  be  satisfied  that  there  is  no 
threat 

The  condition  causing  the  alarm  must  have 
gone  away 

Sensors  at  the  zone  must  be  working 
Test  Sensors 

Clear  by  operating  RESET  ALARMS 

Alarm  message  replaced  by  status  message 
Control  lighting  changes 

Practice  clearing  alarms  for  each  individual 

C.  Access  Procedures 

Purposes  of  access 
Move  SNM 

Repair  or  maintenance 

Author izations 

Two  man  rule 

Mechanical  and  electronic  keys 

Coding  Key 

Lock/Enable 

Key  life  - Two  digit  thumbswitch 
One-time  key 

Only  one  outstanding 
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Master  key 

Multiple  use  - multiple  keys 
Demonstrate  coding  each  type 

Sending  key 

One  minute  window  for  successful  access 
Demonstrate  simulated  procedure  for  access 
Telephone  communication 
Send  key 
Access 

Demonstrate  key  life  expired 
Sending  master  key 

Similar  to  one-time  key  except  multiple  use 
Demonstrate 

Terminating  Access 

Must  close  door 
Telephone  GCS 
Operate  TEST  SENSORS 
Operate  RESET  ALARM 
Describe  conditions  for  successful 
termination 

Door  closed  and  strike  engaged 
No  alarmed  sensors 

Demonstrate  successful  and  unsuccessful 
termination 

D.  Scenario  exercises 

Conduct  all  scenarios  with  each  student. 

Isolate  students  while  others  are  running 
scenarios  until  they  have  done  theirs. 
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A Sample  Scenario 

The  simulated  site  consists  of  ten  perimeter  zones  that 
are  numbered  one  through  ten,  and  nine  magazines  that  are 
numbered  11  through  19.  In  addition,  the  entrance  portal  is 
designated  zone  116,  and  the  Site  Security  Control  Center  is 
designated  zone  114. 

SITE  LAYOUT  FOR  SCENARIO  SHOWING  ZONE  NUMBERS 
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INITIAL  CONDITIONS: 


The  site  is  secure,  but  zone  15  is  operating  on  backup  bat- 
tery power.  An  instructor,  (I),  is  logged  in  on  the  system 
and  can  simulate  the  activities  of  a second  GCS  operator 
(0)  . 

(I)  will  also  simulate  the  actions  of  maintenance  personnel 
and  of  patrol  ABLE  and  BAKER. 


The  director  of  the  simulation  (D)  operates  the  "Terrorist" 
terminal  and  mounts  the  photographs  for  the  fixed  CCTV  cam- 
eras. The  instructor,  (I),  observes  the  performance  of  the 
operator,  (0),  and  records  any  errors  and  any  instances 
where  0 did  not  know  what  to  do  next. 


1. 


2. 


3. 


4. 


5. 

6 . 

7. 

8. 

9. 


I:  Requests  0 to  login. 

0:  Enters  1234567890,  LOGIN 

I:  Announces  that  maintenance  personnel  are  going  to  fix 

zone  15,  and  that  they  should  be  given  a 10  minute  key. 
"Let  me  have  a key  for  zone  15". 

0:  Enters  15,  ZONE  SELECT 

Puts  key  in  port  and  enters  10  (min) , CODE  KEY 
Gives  key  to  I. 

D;  Issues  test  HQ  command 

0:  Operates  TEST  HQ  LINK 

I:  Requests  0 to  test  lamps 

O:  Operates  TEST  LAMPS 

D:  test  sensors  zone  2 


10.  O:  Enters  2,  ZONE  SELECT 

Operates  TEST  SENSORS 

11.  I:  Positions  himself  at  door  of  room  to  act  as  intruder 

12.  D;  alarm  motion  zone  116 

13.  O:  Operates  MPS  and  CCTV  CONTROLS  to  assess  alarm, 

and  dispatches  Patrol  ABLE  to  investigate  at  zone 
116. 

14.  I:  Using  local  phone,  announces;  "We,  the  maintenance 

personnel,  are  at  zone  15  and  want  access." 
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I 


k 


I moves  out  of  the  doorway  and  is  no  longer  visible 
in  the  CCTV  monitor . 


15. 

16. 

17. 

18. 
19. 

20 

21. 

22. 

23. 

24. 

25. 

26. 
27. 


D:  quiet  motion  zone  116 

0;  Enters  15,  ZONE  SELECT 
Operates  SEND  KEY 
"Go  on  in" 

D:  open  door  zone  15 

alarm  e-field  zone  3 

after  instaling  perimeter  zone  photographs 
A5  and  B5  in  cameras  A and  B. 

O:  Operates  MPS 

and  dispatches  patrol  BAKER  to  investigate  zone  3 

I:  Simulating  patrol  ABLE  at  zone  116, 

advises  0 that  an  intruder  has  been  apprehended 
at  zone  116  and  that  the  area  is  clear. 

I:  Unless  0 does  so  without  prompting,  he  should 

be  asked  to  try  to  secure  the  alarm  at  zone  116. 

Note  if  prompt  is  required. 

0:  Operates  MPS  to  bring  up  zone  116 

(Enter  116,  ZONE  SELECT  is  an  acceptable  but 
less  efficient  series  of  actions.) 

Operates  RESET. 

D:  As  soon  as  operator  releases  zone  3,  install 

pictures  A6  and  B6  and  generate  a 
alarm  maid  zone  3 as  soon  as  zone  116  is  secure. 

0:  Operates  MPS  to  acknowledge  alarm  at  zone  3. 

(He  should  now  recognize  intruder  is  in  the 
middle  of  the  clear  zone  between  fences  and 
should  advise  the  enroute  patrol  BAKER  of  this) . 

O:  Simulates  radio  call  to  patrol  BAKER 

"There  is  one  man  inside  the  fence." 

D:  Disables  CCTV  covering  zone  3 

quiet  maid  zone  3 
quiet  e-field  zone  3 
close  door  zone  15 
good  power  zone  15 

0:  Operates  TV  BAD  control. 

I:  Simulates  telephone  call  from  maintenance 
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personnel  at  zone  15  indicating  that  they  have 
vacated  and  locked  the  zone  and  that  it  may  now 
be  secured. 

28.  0:  Enters  15,  and  RESET. 

(O  should  also  advise  the  maintenance  personnel 
of  the  TV  failure  at  zone  3,  and  instruct  them 
to  return  for  an  electronic  key  to  that  zone. 

28.  D:  alarm  motion  zone  18 


29  . 


30. 


0:  Operates  MPS  to  acknowledge. 

Finds  there  is  no  CCTV  to  assess,  so  instructs 
patrol  ABLE  to  investigate. 

D;  quiet  motion  zone  18 
bad  motion  zone  18 


31  I:  Simulates  radio  transmission,  "This  is  patrol  BAKER. 

There  is  no  one  in  zone  3.” 

32.  O:  Reply,  "OK,  resume  regular  patrol." 

Operates  MPS  to  bring  up  zone  3 
Operates  RESET. 

33.  I:  Simulates  radio  transmission,  "This  is  patrol  ABLE. 

The  door  at  zone  18  is  locked  and  all  appears  secure" 


34. 


35. 


36. 


0:  Reply,  "OK  let  me  try  to  secure  the  zone" 

Operates  MPS  to  bring  up  zone  18. 

Operates  RESET.  (It  fails) 

Operates  TEST  SENSORS.  (They  fail,  white  light  on) 

0:  Radio  transmission  to  patrol  ABLE,  "The  sensors 

have  failed  test  at  zone  18.  Post  a guard  there 
until  we  can  get  them  fixed." 

I;  "OK,  I'm  leaving  Smith  on  guard  at  zone  18". 


37 . 


0:  Operates  RESET.  (Green  light  comes  on) 


38.  I:  Simulates  maintenance,  "We  are  here,  what  is  the 

problem".  (Preferably  0 should  send  them  to 
fix  zone  18  and  relieve  the  guard  ahead  of 
making  the  CCTV  repair  at  zone  3) 

39.  O:  Enters  18,  ZONE  SELECT 

Puts  key  in  port,  enters  10  MINS.,  CODE  KEY 
Gives  key  to  I. 

40.  D:  Issues  command  to  test  sensors  zone  11 
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41. 

0;  Enters  11,  ZONE  SELECT 
Operates  TEST  SENSORS 

• 

CM 

I:  " 

We  are  ready  to  access  zone  18" 

43. 

0:  Enters  18,  ZONE  SELECT 

Operates  SEND  KEY 
"Go  on  in" 

44. 

D: 

open  door  zone  18 

45. 

D: 

Inserts  picture  with  deer  in  camera  C 
and  "alarm  e-field  zone  6". 

46. 

0:  Operates  MPS  to  bring  up  zone  6. 

Sees  deer  and  radios  patrol  Baker, 
"There  is  a deer  in  zone  6.  See  if 
chase  him  over  the  fence." 

you 

47. 

D: 

good  motion  zone  18 

00 

. 

I: 

I think  we  have  cleared  the  problem  here 
zone  18.  Will  you  please  test  sensors" 

at 

49. 

0:  Enters  18,  ZONE  SELECT 

Operates  TEST  SENSORS 

Responds,  "Sensors  test  OK  now.  You  can  close 
up  and  bring  Smith  back  with  you.  Remember,  I' 
got  another  problem  at  zone  3." 


PAUSE 


50. 


51. 


52. 


53. 


54. 

55. 
56 

57. 

58. 


D:  close  door  zone  18 

I:  "We  have  locked  up  zone  18  now" 

0:  Operates  RESET 

D:  Puts  deer  picture  in  camera  A 

alarm  maid  zone  7 

0:  Operates  MPS  and  again  sees  deer 

Radio  to  patrol  BAKER,  "Now  he  is  in  zone  7." 

D:  test  sensors  zone  12 

0;  enters  12,  SELECT  ZONE,  TEST  SENSORS 

D:  Replaces  deer  picture  with  clear  zone  camera  A 

I;  "This  is  BAKER.  We  see  him.  He  just  jumped  the 


ve 
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outer  fence. 


59. 

D;  quiet  e-field  zone  6 
quiet  maid  zone  7 

60. 

0:  ”Good,  I'll  secure  both  zones" 

Operates  MPS 
Operates  RESET 
Operates  MPS 
Operates  RESET 

• 

1 — 1 

I: 

Advises  0 that  maintenance  personnel  are  back  and 
want  key  for  zone  3 to  fix  the  CCTV  problem  there. 

62. 

0;  Enters  3,  ZONE  SELECT 

Puts  key  in  port,  enters  10  (min.),  CODE 
Gives  key  to  I 

KEY 

63. 

D:  test  sensors  zone  4 

64. 

0:  Enters  4,  ZONE  SELECT 

Operates  TEST  SENSORS 

(Sensors  test  OK,  but  note  that  there  is  still 
no  CCTV  working  at  zone  3). 

65. 

I: 

Simulating  maintenance,  "We  are  ready  to  access 
zone  3 now  and  fix  your  CCTV". 

66. 

0:  Operates  SEND  KEY 

"Go  on  in" 

67. 

D:  Permits  successful  access 

Requests  TEST  SENSORS  ZONE  4 
(As  soon  as  0 releases  zone  3,  restores  the 
cameras  A & B,  pictures  A9  & B9). 

CCTV 

63. 

0:  Operates  4,  ZONE  SELECT 

Operates  TEST  SENSORS 

69. 

I: 

Simulating  maintenance,  "I  think  we  have 
fixed  your  problem  at  zone  3.  Check  your  TV" 

70. 

0:  Operates  3,  ZONE  SELECT 

(Finds  both  monitors  working) 

Operates  TV  OK 

Advises  maintenance  personnel  that  it  is 

OK. 

PAUSE 
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71. 

D:  close  door  zone  3 

• 

CM 

I: 

"We  have  closed  and  locked  zone 

73. 

0:  Operates  RESET 

74. 

I: 

Would  you  like  to  log  out  now? 

75. 

0:  Enters  1234567890,  LOGOUT 

(Another  guard  will  have  to  login  before  this 
logout  is  accepted  by  the  system) . 
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APPENDIX  II 


Summary  of  Responses  to  Request  for  Comments 


the  military 
gram.  Their 
ceived)  and 
tects  their 


The  following  questionaire  was  given  to  each  of 
personnel  who  participated  in  the  training  pro- 
responses have  been  assembled  (exactly  as  re- 
associated with  a letter  identifier  that  pro- 
privacy . 


COMMENTS 
October  7,  1982 

In  addition  to  any  other  comments  that  you  may  have  about 
the  Computerized  Site  Security  Monitor  and  Response  System 
concept  and  the  simulated  implementation  of  it  that  you  have 
been  working  with  for  the  past  three  days,  please  address 
the  following  questions  about  the  console  itself.  Your 
thoughtful  responses,  together  with  the  rationale  for  them, 
will  be  greatly  appreciated  and  will  be  most  helpful. 

1.  Are  there  any  controls  or  indicators  located  in  posi- 
tions that  you  found  to  be  awkward  or  hard  to  reach?  If  so, 
where  would  you  suggest  that  they  be  relocated? 

A.  (a)  Move  the  Site  Status  Summary  Display  down  to  the 
panel.  Nothing  causes  the  Operator  to  direct  his  attention 
to  its  location.  (b)  Move  the  CCTV  Facilities  at  Selcted 
Zones  more  to  the  center  of  the  console.  Nothing  causes  the 
Operator  to  direct  his  attention  to  them.  (1)  A character 
generator  could  be  used  to  display  the  affected  zone  on  the 
monitor  and  eliminate  the  other  indicators. 

B.  Site  status  lights  should  be  lower  on  the  console.  CCTV 
equipment  lights  should  be  closer  to  the  center  of  the  con- 
sole. 

C.  Move  the  systems  display  down  so  that  it  was  more  visi- 
ble to  the  Operator,  and  move  the  CCTV  indicators  to  a posi- 
tion inside  the  zone  screens  so  that  they  could  be  more 
easily  detected.  This  would  cut  down  on  response  time  when 
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the  Operator  is  assessing  a situation  in  a particular  zone. 
I also  believe  that  I would  move  the  camera  control  handle. 
In  its  present  location  it  inhibits  the  movement  of  one's 
hand  from  the  key  pad  to  the  select  zone  button. 

D.  The  Site  Status  Summary  Display  where  it  is  located  now 
does  not  attract  the  operator's  attention.  Those  summary 
lights  should  be  lowered  to  get  more  attention.  Same  should 
be  done  for  date  and  time  displays.  In  reference  to  the 
CCTV  display  lights  and  zone  indicator  (located  next  to  TVs 
on  outside)  should  be  moved  in  between  the  2 TVs  on  both 
sides.  While  working  controls  you  hve  no  occasion  to  look 
at  lights.  If  moved  between  TVs  much  more  useful  for  opera- 
tors. The  camera  control  knob  should  be  moved  up  away  from 
edge  of  panel.  It  makes  it  awkward  to  move  hands  and  is 
easily  leaned  on  there  for  moving  camera  unintentionally. 

E.  The  zone  CCTV  lights  on  the  side  of  the  panel  should  be 
moved  in  towards  the  center.  Reason  being  that  usually 
there  is  no  reason  to  look  that  far  off  to  the  side.  Also 
the  camera  pan  handle  should  be  moved  up  about  six  inches  so 
it  wont  inhibit  the  movement  of  your  hands  from  side  to  the 
other.  The  functions  lights  at  the  top  should  be  moved  to 
the  control  panel  itself  because  it  is  very  hard  to  be  aware 
of  it  when  it's  way  up  top. 

2.  Did  you  find  the  labeling  of  any  of  the  controls  or 
displays  confusing  or  hard  to  understand?  If  so,  how  do  you 
thing  it  should  be  changed? 

A.  Labeling  of  the  controls  and  indicators  seemed  to  be 
useful  in  the  understanding  and  operation  of  the  console. 
HQ  data  link  is  confusing  unless  it  is  fully  explained, 
i.e.,  what  HQ,  where  it's  located,  and  what  type  link  you 
are  talking  about.  There  are  no  indicators  to  let  the 
operator  know  his  equipment  is  working  or  when  it  fails. 

B.  NO. 

C.  Labeling  quite  satisfactory.  Console  is  uncluttered  by 
unnecessary  labels,  making  controls  easy  to  locate.  CCTV 
indicator  lights  could  be  brighter. 

D.  Lights  on  indicators  should  be  brighter,  especially  the 
green  lights.  Lights  should  not  have  smoke  colored  cover 
over  them.  It  should  be  clear,  especially  the  "no  camera" 
light . 

E.  Some  lights  should  be  brighter. 

3.  Did  you  find  it  easy  or  difficult  to  learn  to  use  the 
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console?  If  so,  describe  what  the  problem  was. 


A. 

B. 


C. 


D. 


Easy  to  understand  and  work  with. 
Easy  to  learn. 

Easy  to  use. 

Very  easy  to  use. 


E.  A challenge,  but  not  very  hard  to  learn. 

4.  What  is  your  opinion  about  the  usefulness  of  the  Monitor 
Pointing  Switch  for  stepping  through  a group  of  uncleared 
alarms? 


A.  It's  big  and  noisey. 

B.  Switch  makes  it  possible  to  see  all  alarms  very  quickly 
and  take  action  for  all  alarms. 

C.  Pointing  switch  extremely  useful.  Seems  to  be  one  of 
the  fundamental  and  essential  features  of  the  system.  Use 
of  the  switch  allows  the  operator  to  pull  all  information  on 
a particular  zone  instantaneously  without  choosing  zones 
that  have  previously  been  selected.  The  operator  would  un- 
doubtedly need  this  capability  in  the  event  that  multiple 
incidents  would  take  place. 


D.  Moving  point  was  very  useful  in  stepping  through  alarms. 
Switch  made  it  possible  for  operator  to  go  through  alarms 
more  quickly  and  get  an  idea  of  how  things  are  going  on  the 
site . 


E.  It  is  all  right. 

5.  When  using  the  Monitor  Pointing  Switch,  did  you  have  any 
difficulty  in  keeping  track  of  the  zone  to  which  your  con- 
trols were  attached?  If  so,  what  would  make  it  easier  for 
you  to  keep  track  of  which  zone  the  controls  are  curently 
associated  with? 

A.  Didn't  find  it  difficult  to  keep  track  of. 

B.  No  problems  with  it. 

C.  No  problem  keeping  track  of  zones.  Any  problems  could 
be  remedied  by  moving  the  CCTV  indicators  in  so  that  he  had 
3 quick  reference  points  close  to  the  center  of  the  screen 
indicating  what  zone  he's  in  at  a given  moment. 
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D,  No  problem  keeping  track  of  zones.  If  you  move  the  CCTV 
equipment  in  between  the  2 TVs  you  would  have  3 items  tel- 
ling him  which  zone  he  was  in. 

E.  When  you  switch  the  lever  over  in  a 2 or  more  alarm  si- 
tuation, the  computer  should  say,  for  example,  vibration 
alarm  zone  2 and  when  you  switch  over  to  the  second  alarm, 
it  should  specify  zone  and  circumstances. 

6.  Did  you  find  the  Pan/Tilt  Zoom  control  easy  to  use?  If 
not,  what  arrangement  of  controls  for  these  functions  do  you 
think  would  have  been  better? 

A.  Easy  to  use  but  compared  to  other  controls  and  indica- 
tors is  large  and  bulky. 

B.  Easy  to  use 

C.  Easy;  no  rearrangement  necessary. 

D.  Easy  to  use.  Should  be  moved  up  on  console. 

E.  Easy  to  use,  but  should  be  moved  up  about  6 inches. 

7.  Are  there  any  other  controls  or  displays  you  think 
should  be  on  the  console?  If  you  answer  yes,  please 
describe  the  form  and  function  of  these  additional  controls 
and/or  displays. 

A.  Some  type  of  indicator  that  would  indicate  the  time 

remaining  on  the  electric  key.  Some  type  of  indicator  that 
will  show  that  a TV  camera  has  gone  bad. 

B.  Would  like  to  test  all  sensors  and  feds  at  once. 

C.  TV  bad  indicator.  A 60  second  count  down  after  sent  key 
and  a time  remaining  indicator  for  keys. 

D.  Camera  down  zone.  Key  code  countdown.  A 60  second 

count  down  display. 

E.  Detailed  map  board  above  the  system  with  led  lights  so 
when  someone  goes  out  and  calls  in  we  know  exactly  where 
they  are  and  can  assist  them  by  giving  them  the  most  direct 
route  possible. 

8.  Are  there  any  controls  or  displays  on  the  console  that 
you  feel  could  be  removed?  If  so,  which  ones,  and  why  do 
you  think  that  they  should  be  removed? 

A.  Difficult  to  say. 
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B. 


No. 


C.  No. 

D.  No. 

E.  No. 

9.  Did  you  find  the  console  to  be  intimidating,  or  friendly 
to  learn  to  use? 

A.  Easy  to  use. 

B.  Easy  to  understand. 

C.  Friendly.  Overloading  an  operator  can  be  a problem  with 
any  security  system 

D.  Very  easy  to  use. 

E.  Friendly 

10.  Do  you  think  that  this  sort  of  simulator  would  be  a 
useful  tool  for  training  personnel  to  work  with  a future 
field  model  Computerized  Site  Security  Monitor  and  Response 
System? 

A.  As  a training  simulator,  it  should  be  set  up  where  the 
computers  could  control  more  than  one  console.  This  would 
cut  down  on  the  cost  and  increase  the  number  of  students 
that  could  be  in  training  at  one  time.  Preprogram  scenarios 
so  the  trainer  doesn't  lose  track  of  what  has  taken  place. 

B.  Yes,  if  the  simulation  was  improved. 

C.  Yes,  but  the  simulation  would  need  a great  deal  of  im- 
provement to  include  the  geographical  display  unit,  video 
type  (instead  of  still  pictures)  and  scenarios 

D.  Yes,  but  computer  should  be  programmed  to  do  everything 
the  terrorist  terminal  does.  Have  precomputerized 
scenarios.  Should  have  video  tapes  camera  pictures. 

E.  Yes.  They  should  have  a school  or  even  a different  MOS 
for  operating  this  unit.  Someone  should  have  a basic 
knowledge  of  computers  and  how  they  work  before  they  operate 
on  a real  ADA  site. 

11.  Please  continue  with  any  other  comments  that  you  wish 
to  make. 
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A.  (1)  Sensor  test  all  at  once  rather  than  individually. 
(2)  Software  to  indicate  the  number  of  times  a sensor  has 
been  activated.  (3)  Eliminate  the  voice  announcement  of  the 
operator  change  and  their  code.  (4)  Ability  to  shut  down 
sensors  for  maintenance  or  due  to  high  nuisance  or  false 
alarm  rate.  (5)  Have  a portion  of  the  computer  that  could 
be  programmed  locally  to  indicate  local  instructions  for  the 
operator  to  follow.  (6)  Green  lights  need  to  be  brighter. 
(7)  Time  for  notification  of  HQ  that  an  operator  has  failed 
to  respond  to  an  alarm  is  too  long.  (8)  FEDS  are  a use  of 
force  and  should  be  dealt  with  the  same  as  the  use  of  a 
weapon,  K-9,  nightstick,  or  MACE.  (9)  Remove  the  term 
"Guard."  (10)  Stop  considering  the  military  police  and  secu- 
rity police  as  dumb.  The  operator  of  this  type  of  equipment 
will  be  highly  motivated  and  educated  to  the  point  that  he 
will  be  able  to  understand  technical  information. 

B.  None. 

C.  My  only  comments  address  the  human  element  and  not  the 
system  itself.  First,  I would  want  to  include  an  exterior 
check  and  balance  system  so  that  the  operators  can  be  moni- 
tored, making  sure  they  are  doing  their  jobs  and  responding 
to  situations  in  an  acceptable  time  span.  Also  for  the  sake 
of  security  and  integrity  of  the  entire  system,  I would  im- 
plement a couse  of  training  for  use  of  system  to  include  a 
"deadly  force"  type  rule  for  the  use  of  FEDS,  and  realistic 
simulations  so  that  the  operator  is  completely  aware  of  his 
responsibilities.  Upon  completion  of  the  couse,  the  indivi- 
dual would  be  certified  to  operate  the  system  and  only  those 
that  are  certified  may  do  so.  This  could  help  in  eliminat- 
ing misuse  of  the  system.  I don't  see  the  system  as  one 
that  should  be  operated  by  just  anyone. 

D.  The  console  is  a pleasure  to  work  with  and  would  really 
be  useful  in  actual  environment.  Having  just  left  a hawk 
missile  tactical  site  in  Germany  I can  see  where  it  would 
fit  in  and  work  exceptionally  well. 

E.  I never  had  any  real  experience  with  computers  but  I had 
no  problem  understanding  principles  behind  the  system. 

12.  Education: 

A.  A/A  in  Police  Science.  Total  of  95  semester  hours  in 
occupational  education  and  computer  programming. 

B.  High  school  diploma.  Private  pilot.  Worked  as  techni- 
cian with  T.C.I.  for  three  years. 

C.  High  school  and  two  years  college  in  fine  arts  and 
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business  administration.  Former  art  director  and  department 
head  for  graphic  arts  company. 


D.  High  school  graduate.  Civilian  police  desk 
and  controls.  Milirary  police  school  graduate. 

E.  High  school  graduate. 
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